Threats tagged 'ghsa-gvmp-m7fp-qm34'

1 threat

Threats tagged 'ghsa-gvmp-m7fp-qm34'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	4.3	EPSS 0.3%	CVE-2026-94536lamp-cloud · Authorization Bypass Through User-Controlled Key Medium4.3EPSS 0.3%2026-09-21CVE Database V5CVE-2026-94536 lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks. EPSS 0.3%Vulnerability dromara #cwe-639 #ghsa-gvmp-m7fp-qm34	CVE Database V5	2026-09-21

Showing 1–1 of 1 result