CVE-2026-94535: lamp-cloud through 5.10.0 Unauthorized Notification Deletion
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
lamp-cloudto a version that resolves this vulnerability.Fixed in 5.10.0 - Compensating control
Restrict access to the DELETE /anyone/extendNotice/deleteMyNotice endpoint (and/or require proper authorization/recipient validation for notice IDs) so users cannot delete notifications belonging to other users.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it. The attacker only needs a valid account and arbitrary notification IDs; no interaction from the notification recipient is required.
What is the impact of successful exploitation?
An attacker can permanently delete notifications belonging to other users. The reported impact is unauthorized modification and partial availability loss, with no stated confidentiality impact.
Which endpoint should defenders investigate?
Review DELETE requests to /anyone/extendNotice/deleteMyNotice, particularly requests where the authenticated caller is not the recipient or owner of the referenced notice ID. Check for unexpected notification deletions and mismatches between the requester and the deleted notification's recipient.
Are affected versions identified?
lamp-cloud through version 5.10.0 is reported as affected. The provided information does not identify a fixed version or a workaround.