CVE-2026-94536: lamp-cloud Information Disclosure Flaw

CVE-2026-94536 Overview

CVE-2026-94536 is a Broken Object Level Authorization (BOLA) vulnerability in lamp-cloud through version 5.10.0, an open-source rapid development platform maintained by the Dromara community. The /anyone/visible/resource endpoint accepts an employeeId parameter without verifying that the requester owns or has rights to that identifier. Any authenticated user can substitute another employee's ID and retrieve their assigned role codes, permission codes, and complete front-end router tree. The flaw is tracked as CWE-639: Authorization Bypass Through User-Controlled Key and enables horizontal privilege reconnaissance across tenants and departments.

Critical Impact
Authenticated attackers can enumerate every employee's roles, permissions, and UI routing structure, exposing the full authorization model of the target deployment.

Affected Products

Dromara lamp-cloud versions up to and including 5.10.0
The lamp-oauth-controller module containing ResourceController
Deployments exposing the /anyone/visible/resource OAuth endpoint

Discovery Timeline

2026-09-21 - CVE-2026-94536 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94536

Vulnerability Analysis

The /anyone/visible/resource endpoint in ResourceController is designed to return the visible resource tree (menus, buttons, and permissions) for a given employee. The handler reads the employeeId request parameter and passes it directly to the service layer that resolves roles and permissions. No check confirms that the supplied employeeId matches the authenticated principal or that the caller is authorized to view another employee's authorization data.

As a result, a low-privilege authenticated user can iterate employeeId values and harvest the entire access-control map of the tenant. Returned data includes role codes, permission codes, and the front-end router structure, effectively disclosing which administrative capabilities exist and who holds them. This intelligence supports targeted follow-on attacks such as credential-focused phishing against high-privilege accounts and abuse of any secondary authorization gaps.

Root Cause

The root cause is a missing object-level authorization check in the controller path documented in the ResourceController source. The application trusts the client-supplied employeeId as the object key without cross-referencing it against the session identity extracted from the authentication context.

Attack Vector

Exploitation requires only a valid low-privileged session and network access to the OAuth service. The attacker issues authenticated HTTP GET requests to /anyone/visible/resource while varying the employeeId query parameter across the enumeration space. Each response reveals the target employee's roles and permission codes. A working proof of concept is published in the GitHub BOLA PoC repository.

No synthetic exploit code is reproduced here. Refer to the linked PoC and the VulnCheck advisory for request/response details.

Detection Methods for CVE-2026-94536

Indicators of Compromise

Repeated authenticated requests to /anyone/visible/resource from a single session with sequential or varying employeeId values.
Access log entries where the employeeId parameter does not match the employeeId claim in the associated JWT or session.
Unusually high response volume from the lamp-oauth service to a single client within a short window.

Detection Strategies

Instrument the OAuth service to log both the authenticated principal's employeeId and the requested employeeId, then alert on mismatches.
Deploy WAF or API gateway rules that count distinct employeeId values requested per session and flag enumeration patterns.
Compare front-end router tree responses across sessions; identical payloads returned to unrelated employees indicate cross-account data exposure.

Monitoring Recommendations

Forward lamp-oauth-controller access logs to a centralized analytics platform for correlation across sessions and source IPs.
Baseline normal request rates against /anyone/visible/resource and alert on statistically significant deviations.
Review privileged accounts whose role and permission codes appear in enumeration responses for downstream signs of credential targeting.

How to Mitigate CVE-2026-94536

Immediate Actions Required

Restrict network exposure of the lamp-oauth service to trusted internal clients until a patched build is deployed.
Introduce a reverse-proxy or API gateway policy that rejects requests where the employeeId parameter differs from the authenticated user's identifier.
Audit historical logs for prior enumeration of /anyone/visible/resource and rotate credentials for any high-privilege accounts whose authorization data was disclosed.

Patch Information

At the time of publication, no fixed release has been identified in the enriched CVE data; all versions through 5.10.0 are affected. Monitor the Dromara lamp-cloud repository and the VulnCheck advisory for a vendor patch, then upgrade to the fixed version once available.

Workarounds

Patch ResourceController locally to derive the employeeId from the authenticated session context and ignore any client-supplied value.
Add a server-side authorization interceptor that enforces session.employeeId == request.employeeId for /anyone/visible/resource and similar endpoints.
Apply rate limiting on the endpoint to slow enumeration attempts while a code fix is prepared.

bash

# Example NGINX guardrail: block requests whose employeeId query parameter
# does not match the employeeId claim forwarded from the auth layer.
location /anyone/visible/resource {
    if ($arg_employeeId != $http_x_auth_employeeid) {
        return 403;
    }
    proxy_pass http://lamp_oauth_backend;
}