HIGH

CVE-2026-94534

2026-09-21 CVSS v3.1

CVSS

7.1

Description

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.

Weakness (CWE)

CWE-639 Authorization Bypass (IDOR)

References

https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-03-anyone-baseinfo-write-bola.py https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-06-anyone-avatar-write-bola.py https://github.com/dromara/lamp-cloud https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L128-L136 https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L68-L78 https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-profile-modification-via-put-endpoints

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE