CVE-2026-94534CWE-639

CVE-2026-94534

High · published September 22, 2026

CVSS v3.1

7.1

EPSS

Percentile

40.9

In the wild

Unconfirmed

What it is

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.

The record

Technical detail

CVSS v3.1: 7.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0: 7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00486 · 40.9th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-09-22T02:17Z

References (6)

https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-03-anyone-baseinfo-write-bola.py · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-06-anyone-avatar-write-bola.py · [email protected]https://github.com/dromara/lamp-cloud · [email protected]https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L128-L136 · [email protected]https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L68-L78 · [email protected]https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-profile-modification-via-put-endpoints · [email protected]

EPSS history

Timeline

23 SEP 03:49Z
EPSS moved — → 0%
epss
21 SEP 21:28Z
lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
cvelistv5