CVE-2026-91996: dromara lamp-cloud

Vulnerability summary

CVE-2026-91996 is a high (CVSS 8.7) vulnerability in dromara lamp-cloud. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 24-09-2026
   Last modifiedVulnerability information updated.

Description

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.