CVE-2026-110763: Authorization Bypass Through User-Controlled Key in zuihou lamp-boot

CVE-2026-110763 is an insecure direct object reference vulnerability affecting lamp-boot versions from 4.16.0-java17 up to and including 4.21.2-java17. The vulnerability exists in the oauth module's /anyone/findDeptByCompany endpoint, which improperly skips URI permission checks. As a result, authenticated users with low privileges can iterate through employeeId values to retrieve department membership details of every employee in the tenant, bypassing intended access controls.

An attacker with low-level authentication can access sensitive organizational information about employee department memberships that should be restricted. This could lead to unauthorized disclosure of internal organizational structure within the tenant. The CVSS 4.0 base score is 5.3, indicating a medium severity impact due to network attack vector, low attack complexity, no user interaction, and low confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint to trusted users only and monitor for unusual access patterns. Avoid exposing the /anyone/findDeptByCompany endpoint to low-privilege users if possible.