CVE-2026-94534: lamp-cloud Auth Bypass Vulnerability

CVE-2026-94534 Overview

CVE-2026-94534 is a Broken Object Level Authorization (BOLA) vulnerability affecting lamp-cloud through version 5.10.0. The flaw resides in two PUT endpoints, /anyone/baseInfo and /anyone/avatar, exposed by the UserInfoController in the lamp-oauth module. These endpoints accept a target user ID in the request body without verifying that the caller owns the referenced account. Any authenticated user can therefore modify arbitrary user profiles, including nickname, ID card number, sex, nation, education, work description, and avatar attachments. The issue is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key] and is documented in the VulnCheck Advisory on Lamp Cloud.

Critical Impact
Authenticated attackers can silently rewrite personally identifiable information and avatars of any user, enabling account tampering, impersonation, and integrity loss across the tenant.

Affected Products

lamp-cloud versions through 5.10.0
lamp-oauth-controller module (UserInfoController.java)
Deployments exposing /anyone/baseInfo and /anyone/avatar PUT endpoints

Discovery Timeline

2026-09-21 - CVE-2026-94534 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94534

Vulnerability Analysis

The UserInfoController in the lamp-oauth module exposes two PUT endpoints intended for a user to update their own baseline profile and avatar. Both handlers read a user identifier directly from the request body and pass it to the update service without correlating the identifier against the authenticated session subject. The controller therefore treats the client-supplied ID as trusted, which is the defining pattern of Broken Object Level Authorization. Practical exploitation requires only a valid session and a target user ID. The relevant handler logic is visible in the UserInfoController baseInfo snippet and the UserInfoController avatar snippet.

Root Cause

The root cause is missing ownership validation between the authenticated principal and the object identifier submitted in the request body. The application accepts a caller-controlled key as the target of the mutation. No server-side check enforces that the session user equals the target user or holds administrative privileges over that record.

Attack Vector

An attacker with any low-privileged authenticated account issues an HTTP PUT request to /anyone/baseInfo or /anyone/avatar. The request body contains a JSON payload with the victim's user ID plus the fields to overwrite. The server processes the update against the victim's record and returns a success response. Proof-of-concept scripts demonstrating both variants are published in the BOLA baseInfo PoC and the BOLA avatar PoC.

No verified exploit code is reproduced here. See the referenced PoC repository for technical details.

Detection Methods for CVE-2026-94534

Indicators of Compromise

PUT requests to /anyone/baseInfo or /anyone/avatar where the request body id or user identifier differs from the authenticated session subject.
Unexpected changes to profile fields such as nickname, idCard, sex, nation, education, or workDescribe outside of normal user self-service activity.
New or altered avatar attachments associated with accounts whose owners did not perform the action.
Spikes in successful PUT calls to /anyone/* endpoints from a single authenticated principal targeting multiple user IDs.

Detection Strategies

Instrument the reverse proxy or API gateway to log the JSON id field submitted to /anyone/baseInfo and /anyone/avatar and compare it against the JWT subject claim.
Correlate authenticated user IDs with modified user IDs in application audit logs; flag any mismatch as high severity.
Enable database-level auditing on the user profile and avatar attachment tables to identify writes that bypass the ownership check.

Monitoring Recommendations

Alert when a single authenticated principal issues profile PUT requests targeting more than one distinct user ID within a short window.
Retain HTTP request bodies for /anyone/* endpoints so that post-incident review can reconstruct which victims were modified.
Baseline normal profile-change frequency per user and alert on deviations that suggest scripted BOLA abuse.

How to Mitigate CVE-2026-94534

Immediate Actions Required

Restrict access to the /anyone/baseInfo and /anyone/avatar PUT endpoints at the API gateway until a patched build is deployed.
Enforce a server-side check that compares the authenticated principal's user ID against the id field in the request body and rejects any mismatch.
Review recent profile modification audit logs for unauthorized changes to nickname, ID card, or avatar fields and restore affected records from backup.
Rotate credentials and re-verify identity attributes for any account whose profile was altered without user consent.

Patch Information

No vendor advisory or fixed release has been referenced in the NVD entry at the time of publication. Monitor the lamp-cloud GitHub project and the VulnCheck Advisory on Lamp Cloud for updates. Until a fix is released, apply the compensating controls listed in the workarounds section.

Workarounds

Add a request filter or Spring HandlerInterceptor that overwrites the body id field with the authenticated user's ID before it reaches the controller.
Deploy a Web Application Firewall (WAF) rule that inspects PUT requests to /anyone/baseInfo and /anyone/avatar and blocks payloads where the body ID does not match the session subject.
Limit which roles may reach the /anyone/* endpoints through gateway-level authorization policies while a code fix is prepared.

bash

# Example WAF rule (ModSecurity style) - block ID mismatch on profile PUT
SecRule REQUEST_METHOD "@streq PUT" \
  "chain,phase:2,deny,status:403,id:1094534,\
   msg:'CVE-2026-94534 lamp-cloud BOLA attempt'"
  SecRule REQUEST_URI "@rx ^/anyone/(baseInfo|avatar)$" \
    "chain"
    SecRule REQUEST_BODY "@rx \"id\"\s*:\s*\"?(?!SESSION_USER_ID)" \
      "t:none"