CVE-2006-5835 in Lotus Domino
Summary
by MITRE
The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability described in CVE-2006-5835 represents a critical authentication flaw within IBM Lotus Notes Domino's Notes Remote Procedure Call protocol implementation. This weakness exists in versions prior to 6.5.5 fix pack 2 and 7.x versions before 7.0.2, creating an exploitable condition that undermines the security posture of email and collaboration systems relying on this platform. The flaw specifically affects the NRPC protocol's user lookup functionality, which should have required proper authentication mechanisms to verify requester identity before providing access to user identification information.
The technical nature of this vulnerability stems from the protocol's failure to enforce authentication checks during user lookup operations. When remote attackers exploit this condition, they can perform user enumeration without providing valid credentials, effectively bypassing the authentication layer that should protect user identity files. This misconfiguration allows unauthorized access to user ID files, which contain critical authentication information including user names, group memberships, and potentially cryptographic keys necessary for system access. The vulnerability operates at the network protocol level, making it particularly dangerous as it can be exploited over network connections without requiring local system access or prior knowledge of valid credentials.
The operational impact of this vulnerability extends beyond simple information disclosure, as user ID files often contain sensitive data that could facilitate further attacks within the organization. Attackers can use the discovered user information to conduct targeted social engineering campaigns, perform credential stuffing attacks against other systems, or escalate privileges within the Domino environment. The vulnerability's remote exploitability means that attackers can leverage this weakness from outside the organization's network perimeter, potentially enabling reconnaissance activities that could lead to more significant breaches. This weakness aligns with CWE-287, which addresses improper authentication issues in network protocols, and represents a fundamental failure in access control implementation.
Organizations affected by this vulnerability should implement immediate mitigations including applying the vendor-provided patches for Domino versions 6.5.5 FP2 and 7.0.2, which address the authentication requirements for NRPC user lookup operations. Network segmentation strategies should be employed to limit access to Domino servers, while implementing strict firewall rules that restrict NRPC traffic to authorized systems only. Monitoring and logging should be enhanced to detect unauthorized user enumeration attempts, and regular security assessments should verify that authentication mechanisms are properly enforced. From an att&ck framework perspective, this vulnerability maps to technique T1087.001 for account discovery and T1566 for credential access, highlighting the reconnaissance and privilege escalation capabilities that attackers can leverage through this weakness. The vulnerability demonstrates the critical importance of proper authentication implementation in network protocols and serves as a reminder that even seemingly minor security gaps can create significant exposure for enterprise systems.