CVE-2026-94535 in lamp-cloud
Summary
by MITRE • 09/21/2026
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The lamp-cloud application, specifically through version 5.10.0, suffers from a critical authorization bypass vulnerability within its notification management subsystem. This flaw is located in the deleteMyNotice API endpoint, which is designed to allow authenticated users to remove their own notifications. However, due to insufficient server-side validation of resource ownership, the implementation fails to verify that the user initiating the deletion request actually owns or has permission to modify the specific notice identified by the provided ID. This represents a classic case of insecure direct object references where the application relies on client-supplied identifiers without enforcing proper access control policies at the point of execution.
From a technical perspective, the vulnerability arises because the backend logic processes DELETE requests for any arbitrary notice identifier passed in the request payload or URL path, regardless of whether that resource belongs to the authenticated session making the call. An attacker who has valid credentials can exploit this by crafting HTTP DELETE requests targeting the /anyone/extendNotice/deleteMyNotice endpoint while specifying notice IDs associated with other users. The system accepts these requests and permanently removes the targeted notifications without raising an error or checking for ownership consistency, effectively treating all notices as publicly deletable by any authenticated actor.
The operational impact of this vulnerability is significant in terms of data integrity and user trust. By deleting another user's notifications, an attacker can disrupt communication workflows, hide important alerts, or cause confusion within collaborative environments that rely on the lamp-cloud platform for internal messaging. This capability undermines the reliability of the notification system and may lead to missed critical updates if malicious actors target specific individuals. Furthermore, this action could be used as part of a broader attack chain to obscure forensic evidence or interfere with audit trails dependent on accurate notification records.
This vulnerability aligns closely with CWE-639, which describes authorization bypass through resource ID manipulation, and maps directly to the MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials to perform unauthorized actions within a system. The lack of proper object-level access control allows for privilege escalation in terms of data modification rights, even if no higher user privileges are gained.
To mitigate this issue, developers must implement strict server-side validation that verifies the relationship between the authenticated user and the resource being accessed before processing any deletion request. This involves querying the database to confirm that the notice ID belongs exclusively to the requesting user's account prior to executing the delete operation. Additionally, implementing role-based access control checks can provide an extra layer of security by ensuring only authorized roles can perform administrative actions on notifications. Regular code reviews focusing on authorization logic and automated testing for broken object level permissions are recommended to prevent similar vulnerabilities in future releases.