CVE-2026-110763: lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated low-privilege user in the affected tenant can exploit it. No additional privileges or user interaction are required.
What information can an attacker obtain?
An attacker can iterate sequential employeeId values and read department-membership information for every employee within their tenant. The provided data does not indicate access to other employee data or other tenants.
Which deployments are affected?
lamp-boot versions 4.16.0-java17 through 4.21.2-java17 are affected in the oauth module endpoint /anyone/findDeptByCompany. The endpoint skips URI permission checks.