CVE-2026-94532
6.5 MEDIUMpublic exploit availablePublished 2026-09-21 · Updated 2026-09-21
AI risk analysis
- Summary
- The flaw allows authenticated users to read other users' full profiles, including sensitive information like mobile numbers and national identity card numbers.
- Exploitability
- Exploitation requires authentication but is relatively straightforward due to the ability to iterate through userId parameters.
- Blast radius
- If exploited, it could lead to significant data breaches affecting multiple users’ private information.
- Prioritized remediation
- Update to the latest version of lamp-cloud (5.10.1 or later) which includes a fix for this vulnerability.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-639
Public exploit & PoC references
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-01-anyone-userinfo-bola.py
- https://github.com/dromara/lamp-cloud
- https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L55-L61
All references
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-01-anyone-userinfo-bola.py
- https://github.com/dromara/lamp-cloud
- https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L55-L61
- https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-user-profile-access-via-getuserinfobyid
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-71420PoC
- MEDIUMCVE-2026-52743PoC
- LOWCVE-2026-55060PoC
- CRITICALCVE-2026-63456
- HIGHCVE-2026-6639
- MEDIUMCVE-2026-70491PoC
- MEDIUMCVE-2026-75158PoC
- MEDIUMCVE-2026-94213
Related by shared AI tags and CWE weakness class. Browse the full archive.