CVE-2026-94535 in lamp-cloud

Tóm tắt

Bởi MITRE • 22/09/2026

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• chịu trách nhiệm: VulnCheck
• Đặt trước: 21/09/2026
• Tiết lộ: 22/09/2026
• Kiểm duyệt: được chấp nhận
• mục: VDB-408315
• CPE: sẵn sàng
• CWE: CWE-639 (Đã xác nhận)
• CVSS: 7.1 (CNA)
• EPSS: 0.00000
• KEV: không
• Các hoạt động: rất thấp
• ngành: Hospital, Insurance, ...

Nguồn

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-94535
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94535
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-94535/