CVE-2026-94532: lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById
Published Sep 21, 2026
·Updated
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.
Affected Software
1 affected component
lamp-cloud<=5.10.0
Event History
Sep 21, 2026
CVE Published
via MITRE·09:28 PM
Data Sourced
via MITRE·09:28 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs an authenticated account with low privileges. No user interaction is required.
2
What information could be exposed if the issue is exploited?
An attacker may read other users' full profiles, including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.