Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-21T22:17:00.010Z",
  "pubdate": "2026-09-21T22:17:00.010Z",
  "executiveSummary": "The lamp-cloud framework, specifically versions up to and including 5.10.0, is affected by an authorization bypass vulnerability located within the getUserInfoById endpoint. This security flaw stems from an Insecure Direct Object Reference (IDOR) pattern that fails to properly validate the authorization context of the requesting user against the requested resource. The vulnerability allows any authenticated user to perform unauthorized read operations on the full profiles of other users within the system. By manipulating the userId parameter, an attacker can systematically scrape sensitive personally identifiable information (PII). The impact is significant, as it facilitates the mass harvesting of mobile numbers, email addresses, national identity card numbers, and third-party integration identifiers such as WeChat and DingTalk OpenIDs. The vulnerability poses a severe risk to user privacy and data integrity, potentially leading to identity theft or targeted phishing campaigns if the harvested data is exfiltrated. Exploitation is trivial, requiring only a valid user session and the ability to traverse incremental or guessable numerical identifiers in the API request, bypassing existing access control logic.",
  "technicalDetails": "The vulnerability originates in the getUserInfoById endpoint, which lacks robust server-side authorization checks to verify that the requesting user has the appropriate permissions to access the profile data associated with the provided userId. This constitutes a classic IDOR vulnerability where the application trusts user-supplied input to determine data access scope without validating ownership or administrative privilege.\nThe exploitation process is straightforward and involves an authenticated user interacting with the application's RESTful API. Upon invoking the getUserInfoById endpoint, the attacker provides a specific userId parameter in the request body or URL path. Because the backend application logic fails to compare the session-based User ID with the target resource identifier, the server executes a database query to retrieve the full profile corresponding to the attacker-supplied parameter. By iterating through sequential or brute-forceable userId values, an attacker can programmatically enumerate the entire user database.\nThe data returned in the response payload includes highly sensitive PII that should be restricted based on the principle of least privilege. Specifically, the exposure of national identity card numbers and third-party OpenIDs (WeChat/DingTalk) grants an attacker significant intelligence for potential account takeovers or further lateral movement into third-party integrated services. The technical flaw essentially acts as an unauthenticated information disclosure mechanism for any party possessing a valid, low-privileged session token.\nAffected versions include all iterations of lamp-cloud up to and including 5.10.0. The vulnerable component is the controller responsible for user information management. Since the application fails to perform an authorization context check—verifying if the current session token represents the owner of the requested profile or an authorized administrator—the security posture is bypassed entirely. Post-exploitation impact is catastrophic regarding data confidentiality, as the lack of rate-limiting or anomalous request detection often allows for rapid bulk data exfiltration from the underlying data store."
}