CVE-2026-94536: lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource
lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a lamp-cloud user and able to send requests to the /anyone/visible/resource endpoint. No user interaction is required.
What information can be exposed?
By supplying arbitrary employeeId values, an authenticated user can enumerate other employees' role codes, permission codes, and complete front-end router trees.
Are deployments through version 5.10.0 affected by default?
The affected behavior is reported for lamp-cloud through 5.10.0. The provided data does not identify a configuration prerequisite or mitigation that would prevent exposure.
How can I determine whether my deployment is vulnerable?
While authenticated as a user, test whether /anyone/visible/resource returns role, permission, or router data for an employeeId belonging to another employee. Returning that data without an authorization check indicates the issue is present.