CVE-2026-94536

Received Received - Intake

Authenticated Information Disclosure in LAMP-Cloud

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-94536

EUVD

EUVD-2026-84210

Affected Vendors & Products

Vendor	Product	Version / Range
lamp-cloud	lamp-cloud	From 5.10.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

lamp-cloud through version 5.10.0 has an authorization flaw in the /anyone/visible/resource endpoint. Authenticated users can manipulate the employeeId parameter to access other employees' roles and permissions without proper validation. This allows enumeration of role codes, permission codes, and front-end router trees for any user.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the /anyone/visible/resource endpoint for unauthorized access attempts. Check for requests with arbitrary employeeId values or missing authentication headers. Review logs for repeated requests with different employeeId parameters.

Impact Analysis

An attacker with valid credentials could exploit this to gather sensitive access information about other users. This includes their permissions and roles, which could be used for further attacks like privilege escalation or lateral movement within the system.

Compliance Impact

This vulnerability likely violates data protection requirements in GDPR and HIPAA by allowing unauthorized access to sensitive user permission data. It compromises the principle of least privilege and could lead to unauthorized data exposure, triggering compliance violations and potential fines.

Mitigation Strategies

Immediately restrict access to the /anyone/visible/resource endpoint to authorized users only. Implement input validation for the employeeId parameter to ensure it matches the authenticated user's ID. Update lamp-cloud to the latest version if a patch is available.

Hi! I’m here to help you understand CVE-2026-94536. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70