CVE-2026-94532

lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById

HIGH 7.1EPSS 0.4%

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.

Affected: dromara · lamp-cloud
CVSS v4.0 VULNCHECK: 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULNCHECK: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.44% chance of exploitation in the next 30 days, 36th percentile
Published: 2026-09-21
Updated: 2026-09-24

Proof-of-concept exploits (1)

LinYuanyi1/cve-request-poc/blob/master/lamp/poc-01-anyone-userinfo-bola.py1★ · 2026-09-19

CVE-2026-94532

Proof-of-concept exploits (1)

References