CVE-2026-94535 Overview
CVE-2026-94535 is an authorization bypass vulnerability in lamp-cloud through version 5.10.0. The flaw resides in the deleteMyNotice endpoint, which fails to validate that the requesting user owns the notification being deleted. Any authenticated user can call DELETE /anyone/extendNotice/deleteMyNotice with arbitrary notice IDs to permanently remove notifications belonging to other users. The issue is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key) and represents a classic Broken Object Level Authorization (BOLA) pattern.
Critical Impact
Authenticated attackers can permanently destroy notification data belonging to any user in the system, disrupting business communications and audit trails.
Affected Products
- lamp-cloud versions through 5.10.0
- ExtendNoticeServiceImpl component in lamp-base-biz module
- The deleteMyNotice API endpoint exposed under /anyone/extendNotice/
Discovery Timeline
- 2026-09-21 - CVE-2026-94535 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-94535
Vulnerability Analysis
The vulnerability affects the notification management subsystem of lamp-cloud, a Java-based microservices platform built on Spring Cloud. The deleteMyNotice endpoint accepts one or more notice identifiers and removes the corresponding records from the database. The service method processes the deletion using only the supplied notice IDs, without cross-referencing the authenticated user's identity against the recipient field of each notice.
The endpoint path /anyone/extendNotice/deleteMyNotice follows a naming convention suggesting user-scoped deletion, yet the underlying implementation performs an unfiltered delete operation. An attacker with any valid session token can enumerate notice IDs and issue DELETE requests to erase notifications belonging to administrators, executives, or other users. The vulnerable logic is documented in the ExtendNoticeServiceImpl.java implementation.
Root Cause
The root cause is missing recipient validation in the service layer. The deleteMyNotice method trusts client-supplied identifiers and does not include a WHERE clause matching the current principal's user ID. This is the canonical BOLA pattern described in CWE-639, where an authorization decision depends on a user-controlled key that the server never verifies against the session context.
Attack Vector
Exploitation requires only low-privilege authenticated access to the lamp-cloud API. An attacker sends a DELETE request to /anyone/extendNotice/deleteMyNotice supplying notice IDs owned by other users. Identifiers can be discovered through enumeration, log inspection, or adjacent endpoints that expose notice metadata. A working proof-of-concept is published in the GitHub PoC repository.
See the VulnCheck Advisory on lamp-cloud for additional technical context.
Detection Methods for CVE-2026-94535
Indicators of Compromise
- Unexpected DELETE requests to /anyone/extendNotice/deleteMyNotice originating from low-privilege user accounts.
- Notification records missing from the database without corresponding audit entries tied to the recipient user.
- Single user sessions issuing sequential deletion requests across a wide range of notice identifiers.
- User complaints about missing system notifications, alerts, or workflow messages.
Detection Strategies
- Deploy application-layer logging that captures the authenticated principal, target notice ID, and recipient user ID on every deletion call.
- Correlate the acting user against the notice recipient at the reverse proxy or WAF and alert on mismatches.
- Baseline normal deletion volume per user and flag accounts exceeding statistical thresholds.
Monitoring Recommendations
- Ingest lamp-cloud application logs into a centralized data lake and build queries that detect BOLA patterns across notification endpoints.
- Audit the notification table for orphaned or bulk deletions and reconcile against application-level audit trails.
- Monitor for enumeration behavior such as sequential integer IDs in DELETE requests originating from a single session.
How to Mitigate CVE-2026-94535
Immediate Actions Required
- Inventory all lamp-cloud deployments and identify instances running version 5.10.0 or earlier.
- Restrict access to the /anyone/extendNotice/deleteMyNotice endpoint at the API gateway until a patch is applied.
- Rotate session tokens and revoke API keys for accounts observed abusing the endpoint.
- Review notification database backups to determine the scope of any unauthorized deletions.
Patch Information
At the time of publication, no fixed release has been referenced in the NVD entry. Track upstream fixes in the dromara/lamp-cloud repository and apply security updates as soon as they are released. Organizations that maintain forks should add a recipient check in ExtendNoticeServiceImpl.deleteMyNotice that compares the notice's owner field to the authenticated user's ID before executing the delete.
Workarounds
- Add a gateway rule that blocks DELETE requests to /anyone/extendNotice/deleteMyNotice from all users pending remediation.
- Implement a server-side authorization filter that rejects deletions when the notice recipient does not match the JWT subject claim.
- Enable soft-delete semantics on the notification table so unauthorized removals can be reverted from audit records.
- Restrict API access by network segment or VPN until the recipient validation fix is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.