CVE-2026-110763

Deferred Deferred - Pending Action

Insecure Direct Object Reference in lamp-boot OAuth Module

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110763

EUVD

EUVD-2026-101563

Affected Vendors & Products

Vendor	Product	Version / Range
zuihou	lamp-boot	4.16.0-java17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-110763 is an Insecure Direct Object Reference (IDOR) vulnerability in the lamp-boot project's /anyone/findDeptByCompany endpoint. Authenticated users can bypass permission checks by supplying sequential employee IDs to view other employees' department memberships within the same tenant. The flaw exists because the endpoint does not verify if the requested employee ID matches the caller's identity.

Detection Guidance

To detect this vulnerability, check if your lamp-boot application (versions 4.16.0-java17 to 4.21.2-java17) exposes the /anyone/findDeptByCompany endpoint. Test with authenticated low-privilege user credentials by sending sequential employeeId values and verify if unauthorized department data is returned. Monitor logs for repeated requests to this endpoint with varying employee IDs.

Impact Analysis

An attacker with low privileges could enumerate employee IDs to access sensitive organizational data, including department structures and employee relationships. This could lead to unauthorized data exposure, potential privacy violations, and misuse of internal information within the affected tenant.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR (unauthorized access to personal data) and HIPAA (exposure of sensitive employee information). It undermines principles of least privilege and data minimization, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately update lamp-boot to a patched version beyond 4.21.2-java17. As a temporary fix, restrict access to the /anyone/findDeptByCompany endpoint by implementing proper authorization checks to ensure only authorized users can query department data. Bind employeeId lookups to the authenticated user's session context.

Hi! I’m here to help you understand CVE-2026-110763. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70