CVE-2026-94534: lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require administrator privileges or user interaction?
No administrator privileges or user interaction are indicated. The CVSS vector shows that a low-privileged authenticated attacker can exploit the issue remotely over the network with low attack complexity.
Does this issue expose profile data, or does it primarily allow changes?
The reported impact is primarily unauthorized modification of other users' profile data and avatar attachments. The CVSS vector indicates no confidentiality impact, high integrity impact, and low availability impact.