Log in / Sign up

Vulnerability details

CVE-2026-94532

dromara lamp-cloud

lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById

CVSS 4.0
7.1High

Official description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.

CVSS scores

ScoreVersionSourceVector
7.1High 4.0 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
6.5Medium 3.1 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

VendorProductVersionsSource
dromara lamp-cloud v ≤ 5.10.0 CVEProject cvelistV5 (CNA)

References and advisories

4
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-09-22
Last updated
2026-09-25
State
Published
Assigner (CNA)
VulnCheck

Exploit prediction (EPSS)

0.43%
Probability of exploitation in 30 days
38%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-639
    Authorization Bypass Through User-Controlled Key