CVE-2026-5529: dromara lamp-cloud Incorrect Privilege Assignment
Vulnerability summary
CVE-2026-5529 is a medium (CVSS 5.3) Incorrect Privilege Assignment vulnerability in dromara lamp-cloud. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 05-04-2026PublishedVulnerability first disclosed.
- 06-04-2026Last modifiedVulnerability information updated.
Description
A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component DefUserController. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.0MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
+0.08 pp
From 0.27% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLamp Cloud
Maturity: poc
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Dromara1 product
- lamp-cloud5.8.0 | 5.8.1
1 vendor · 1 product
References
5 links- vuldb.com/submit/782103Third Party Advisory