CVE-2026-94534

Received Received - Intake

Authentication Bypass in LAMP-Cloud User Profile Update

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-94534

EUVD

EUVD-2026-84208

Affected Vendors & Products

Vendor	Product	Version / Range
lamp-cloud	lamp-cloud	to 5.10.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

lamp-cloud through version 5.10.0 has an identity validation flaw in two endpoints: PUT /anyone/baseInfo and PUT /anyone/avatar. Authenticated attackers can exploit this to modify profiles of other users by supplying their user IDs in request bodies. This allows changing sensitive profile fields like nickname, ID card, sex, nation, education, work description, and avatar attachments.

Detection Guidance

To detect this vulnerability, monitor HTTP PUT requests to /anyone/baseInfo and /anyone/avatar endpoints. Check for requests with modified user IDs in the request body and unauthorized profile changes. Use network traffic analysis tools like Wireshark or tcpdump to inspect PUT requests for suspicious patterns.

Impact Analysis

If you use lamp-cloud versions up to 5.10.0, an attacker with valid credentials could impersonate you by altering your profile. They could change your personal details, upload malicious content as your avatar, or falsify information tied to your account. This could lead to reputational damage, misinformation spread under your identity, or potential access to restricted data.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized modification of personal data, undermining integrity and user consent. For HIPAA, it risks exposing or altering protected health information if profile fields include such data. Both standards require strict access controls and data integrity; this flaw fails those requirements.

Mitigation Strategies

Immediately update lamp-cloud to the latest version beyond 5.10.0. Implement strict input validation for user IDs in PUT requests. Restrict access to these endpoints to authenticated users only. Review logs for unauthorized profile modifications and revoke compromised sessions.

Hi! I’m here to help you understand CVE-2026-94534. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70