CVE-2026-94532 Overview
CVE-2026-94532 is an authorization bypass vulnerability in lamp-cloud through version 5.10.0, an open-source enterprise development platform maintained by the dromara organization. The flaw resides in the getUserInfoById endpoint exposed by UserInfoController, which fails to verify that the requesting user is authorized to read the target profile. Any authenticated user can iterate the userId parameter to enumerate other users and retrieve their complete profile records. Exposed fields include mobile phone numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs. The issue is tracked as a Broken Object Level Authorization (BOLA) weakness [CWE-639].
Critical Impact
Authenticated attackers can harvest personally identifiable information (PII) for every user in a lamp-cloud tenant by incrementing a single integer parameter.
Affected Products
- lamp-cloud versions through 5.10.0
- lamp-oauth-controller module (UserInfoController)
- Deployments of the dromara/lamp-cloud framework at or below the affected release
Discovery Timeline
- 2026-09-21 - CVE-2026-94532 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-94532
Vulnerability Analysis
The vulnerability is a classic Broken Object Level Authorization pattern. The getUserInfoById handler in UserInfoController accepts a userId parameter from the request and returns the corresponding user record without confirming that the caller owns the requested identifier or holds an administrative role. Because lamp-cloud uses sequential numeric identifiers, an authenticated low-privilege user can walk the ID space to exfiltrate every profile in the database.
The returned payload contains fields that fall under strict data-protection regimes, including mobile numbers, email addresses, national identity card numbers, and third-party OpenIDs for WeChat and DingTalk. Aggregated exposure of these attributes enables downstream account takeover, SIM-swap targeting, phishing, and identity fraud. The affected endpoint is reachable over the network and requires only standard user credentials, keeping exploitation cost low.
Root Cause
The controller performs functional authentication but does not enforce object-level authorization. The handler at lines 55-61 of UserInfoController.java resolves the user identity from the input parameter rather than from the authenticated session principal. No ownership check, role check, or tenant boundary check is applied before the database lookup returns the full user record.
Attack Vector
An attacker authenticates to lamp-cloud with any valid low-privilege account and issues repeated requests to getUserInfoById, incrementing the userId value on each call. Each response yields the target user's full profile. A public proof-of-concept script demonstrates the enumeration pattern against the affected endpoint. See the GitHub PoC for BOLA and the VulnCheck Advisory for Lamp-Cloud for verified technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-94532
Indicators of Compromise
- Bursts of sequential requests to /getUserInfoById with monotonically incrementing userId values from a single session or token.
- Single authenticated principal accessing profile records for a large number of distinct userId values within a short window.
- Application logs showing user-info responses returning identifiers that do not match the authenticated caller.
Detection Strategies
- Instrument the UserInfoController to log the authenticated principal alongside the requested userId and alert on mismatches.
- Deploy web application firewall (WAF) rules that rate-limit and flag high-cardinality access to getUserInfoById from a single session.
- Baseline normal per-user access volumes to profile endpoints and alert on statistical outliers indicative of enumeration.
Monitoring Recommendations
- Forward lamp-oauth access logs and application audit trails to a central analytics platform for correlation and long-term retention.
- Monitor egress traffic from application servers for large volumes of PII leaving the environment following suspicious API activity.
- Track authentication token reuse patterns to identify accounts sweeping the user ID space.
How to Mitigate CVE-2026-94532
Immediate Actions Required
- Restrict network exposure of the lamp-cloud OAuth service to trusted clients only until a patched build is deployed.
- Apply a server-side authorization filter that rejects getUserInfoById calls where the requested userId does not match the authenticated principal or an administrative role.
- Rotate credentials and OpenID bindings for any user whose profile may have been accessed during the exposure window.
Patch Information
No fixed release is referenced in the NVD entry at the time of publication. Track the upstream project at the GitHub Lamp-Cloud Repository and the vulnerable handler at the GitHub UserInfoController Source for remediation updates. Consult the VulnCheck Advisory for Lamp-Cloud for coordinated guidance.
Workarounds
- Override getUserInfoById in a reverse-proxy or API gateway layer to enforce that the userId parameter equals the authenticated user's identifier.
- Replace direct object references with opaque, per-session tokens so attackers cannot enumerate sequential integers.
- Disable the getUserInfoById endpoint entirely if application functionality permits until an authorization fix is available.
# Configuration example
# See the VulnCheck advisory and upstream repository for vendor-supplied remediation guidance.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
