CVE-2026-94532
lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 21, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 21, 2026
Description
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
lamp-clouddromara |
|
References
- Proof of conceptexploit
- Vulnerable codetechnical-description
- https://github.com/dromara/lamp-cloudproduct
- VulnCheck Advisory: lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoByIdthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.