CVE-2026-94536: dromara lamp-cloud

Vulnerability summary

CVE-2026-94536 is a medium (CVSS 5.3) vulnerability in dromara lamp-cloud. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 21-09-2026
   PublishedVulnerability first disclosed.
2. 23-09-2026
   Last modifiedVulnerability information updated.

Description

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.