CVE-2026-91996
Received Received - Intake

Unauthenticated JVM Properties Exposure in lamp-cloud

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91996
EUVD
EUVD-2026-78436

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
lamp-cloud lamp-cloud to 5.10.0 (inc)
dromara lamp-cloud to 5.10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in lamp-cloud through version 5.10.0 allows unauthenticated attackers to read the server's full JVM system property map by sending POST requests to /defGenProject/anno/getProperties. The endpoint is whitelisted via the path pattern /*/anno/**, bypassing authentication and exposing sensitive system details.

Detection Guidance

Check if the endpoint /defGenProject/anno/getProperties is accessible without authentication by sending a POST request to it. Use tools like curl: curl -X POST http://<target>/defGenProject/anno/getProperties. If the server responds with JVM system properties, the vulnerability is present.

Impact Analysis

Attackers can retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets. This could lead to further attacks like privilege escalation, data exfiltration, or system compromise if secrets are exposed.

Compliance Impact

This vulnerability may violate compliance requirements by exposing sensitive system information, potentially leading to unauthorized data access. GDPR and HIPAA require protection of personal and health data, and such breaches could result in legal penalties or reputational damage.

Mitigation Strategies

Remove or restrict access to the /defGenProject/anno/getProperties endpoint. Update the whitelist pattern in IgnoreProperties.baseUri to exclude this path. Ensure all sensitive endpoints require proper authentication and authorization checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart