CVE-2026-94536 in lamp-cloud
Summary
by MITRE • 09/22/2026
lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in lamp-cloud versions up to 5.10.0 represents a critical failure in server-side access control mechanisms, specifically categorized under CWE-284 Improper Access Control. The core technical flaw resides within the /anyone/visible/resource endpoint, which is designed to retrieve resource visibility information for employees. However, the implementation fails to enforce proper authorization checks on the employeeId parameter supplied by the client. This oversight allows any authenticated user to manipulate this input field with arbitrary values, effectively bypassing the intended security boundaries that restrict data access to only authorized personnel or specific organizational units.
From an operational perspective, this flaw enables a severe information disclosure attack vector. An attacker who has obtained valid authentication credentials can systematically iterate through employee identifiers to enumerate sensitive internal data structures. This includes retrieving role codes and permission sets for any user within the system, which reveals the organization's security policy configuration in detail. Furthermore, the ability to extract complete front-end router trees provides attackers with a comprehensive map of the application's navigation structure and available endpoints. This intelligence is particularly dangerous as it facilitates further reconnaissance, allowing adversaries to identify additional potential attack surfaces or less secure API endpoints that may not be immediately visible through standard user interaction.
The impact extends beyond simple data leakage into broader system compromise risks. By understanding the role hierarchy and permission codes, an attacker can better tailor subsequent attacks, such as privilege escalation attempts against other users with higher clearance levels. The exposure of router trees also aids in mapping out the application logic, making it easier to identify logical flaws or unpatched vulnerabilities in specific modules that rely on similar access control patterns. This type of vulnerability is often associated with Broken Object Level Authorization (BOLA) attacks within the OWASP API Security Top 10 framework, where the server trusts client-supplied identifiers without verifying if the requester has permission to view data for those objects.
To mitigate this risk, immediate remediation efforts should focus on implementing robust authorization checks at the service layer rather than relying solely on frontend restrictions or implicit trust in input parameters. Developers must ensure that every request involving sensitive employee data verifies that the authenticated user is either the owner of the requested resource or possesses administrative privileges to view other users' details. This can be achieved by integrating a centralized access control middleware that validates permissions against the current session's identity and role hierarchy before processing any requests related to employee resources. Additionally, implementing rate limiting on this endpoint can help mitigate automated enumeration attacks while more permanent fixes are deployed. Regular security audits and static code analysis focused on object-level authorization patterns are recommended to prevent similar vulnerabilities in other parts of the application architecture aligned with ATT&CK techniques for discovery and credential access.