CVE-2026-94532 in lamp-cloud
Summary
by MITRE • 09/22/2026
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The lamp-cloud framework, specifically in versions up through 5.10.0, suffers from a critical authorization bypass vulnerability within its getUserInfoById endpoint. This flaw stems from an insufficient server-side validation of the userId parameter provided by authenticated clients. In a properly secured system, an API endpoint designed to retrieve user information should verify that the requesting user has administrative privileges or is explicitly authorized to access data for the specified target identifier. However, in this implementation, the application fails to enforce these access controls effectively. Consequently, any authenticated user can manipulate the userId parameter to request profile details belonging to other system users without restriction. This represents a fundamental failure in implementing proper object-level authorization checks, allowing lateral movement within the application's data layer by simply iterating through sequential or predictable user identifiers.
The operational impact of this vulnerability is severe due to the sensitivity of the data exposed. By exploiting this flaw, an attacker can harvest comprehensive personal identifiable information (PII) for any registered user in the system. The accessible data fields include mobile phone numbers, email addresses, national identity card numbers, and unique social media identifiers such as WeChat OpenIDs and DingTalk OpenIDs. This level of exposure facilitates a wide range of downstream attacks including targeted phishing campaigns known as spear-phishing, account takeover attempts via credential stuffing or password reset abuse using the harvested contact information, and potential identity theft scenarios where national ID numbers are combined with other personal details. The ability to iterate through user IDs means that an attacker can systematically scrape the entire database of users if they possess valid authentication credentials for even a single low-privilege account.
From a classification perspective, this vulnerability aligns directly with CWE-284 Improper Access Control and more specifically CWE-639 Authorization Bypass Through User-Controlled Key. The core issue is not that the user lacks an identity but that their established identity does not restrict access to resources outside of their own scope. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1078 Valid Accounts and potentially T1539 Steal Web Session Cookie if session tokens are also harvested or manipulated during the enumeration process. The exploitation relies on the attacker's ability to send crafted HTTP requests with modified parameters while maintaining a valid authentication context, which is typical of broken object level authorization attacks found in modern web applications and APIs.
Mitigation strategies must focus on enforcing strict access control policies at both the application logic layer and potentially the database query layer. Developers should implement explicit checks that verify whether the authenticated user's ID matches the target userId requested in the API call, unless the user holds a specific administrative role with permission to view other profiles. Additionally, implementing rate limiting on this endpoint can help mitigate automated enumeration attacks by detecting rapid successive requests for different user IDs. Input validation alone is insufficient; the primary fix must be logical access control enforcement ensuring that users are only permitted to retrieve data associated with their own account identity. Regular security audits and penetration testing focusing on broken object level authorization flaws are recommended to identify similar patterns in other endpoints within the lamp-cloud ecosystem.