CVE-2026-94536

Summary

The flaw allows authenticated users to read any employee's roles and permissions by exploiting the unvalidated employeeId parameter, posing a security risk.

Exploitability

Exploitation is relatively easy as it requires an authenticated user with access to the /anyone/visible/resource endpoint. Precondition is that the attacker must be logged in.

Blast radius

If exploited, this could lead to unauthorized access to sensitive employee information and potential misconfiguration of front-end permissions.

Prioritized remediation

Update to lamp-cloud version 5.10.1 or later which includes validation fixes for the employeeId parameter.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.