{"id":"CVE-2026-94536","published":"2026-09-21T22:17:00.640","lastModified":"2026-09-21T22:17:00.640","description":"lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-05-anyone-visible-resource-bola.py","tags":[]},{"url":"https://github.com/dromara/lamp-cloud","tags":[]},{"url":"https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/ResourceController.java#L56-L82","tags":[]},{"url":"https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-information-disclosure-via-anyone-visible-resource","tags":[]}],"exploitRefs":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-05-anyone-visible-resource-bola.py","tags":[]},{"url":"https://github.com/dromara/lamp-cloud","tags":[]},{"url":"https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/ResourceController.java#L56-L82","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated users to read any employee's roles and permissions by exploiting the unvalidated employeeId parameter, posing a security risk.","exploitability":"Exploitation is relatively easy as it requires an authenticated user with access to the /anyone/visible/resource endpoint. Precondition is that the attacker must be logged in.","blast_radius":"If exploited, this could lead to unauthorized access to sensitive employee information and potential misconfiguration of front-end permissions.","remediation":"Update to lamp-cloud version 5.10.1 or later which includes validation fixes for the employeeId parameter.","tags":["auth-bypass","permissions","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:34:22.519Z"}}