Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-21T22:17:00.487Z",
  "pubdate": "2026-09-21T22:17:00.487Z",
  "executiveSummary": "The lamp-cloud platform, specifically versions through 5.10.0, is affected by a critical Broken Access Control (BAC) vulnerability located within the notification management subsystem.\nThis authorization bypass flaw resides in the deleteMyNotice endpoint, which fails to implement robust server-side validation regarding object ownership.\nThe vulnerability allows any authenticated user to perform unauthorized deletion of notifications belonging to other system users.\nBy manipulating the notice ID parameter, an attacker can systematically delete arbitrary notification records, leading to unauthorized data destruction and potential information availability impact.\nThe flaw stems from a lack of authorization checks where the application does not verify if the authenticated requester possesses the necessary permissions to modify the targeted notification resource.\nExploitation requires a valid user session, but does not necessitate elevated administrative privileges, making it a significant risk for multi-tenant or collaborative environments relying on notification integrity.",
  "technicalDetails": "The vulnerability is classified as an Improper Authorization flaw, specifically categorized under Broken Access Control, where the application logic fails to restrict object access based on user identity.\nThe vulnerable component is the /anyone/extendNotice/deleteMyNotice endpoint, which is designed to allow users to remove their own notifications.\nThe root cause of this vulnerability is the absence of server-side recipient validation logic within the controller or service layer responsible for processing the DELETE request.\nWhen a user invokes the DELETE method on the specified endpoint, the backend service accepts an arbitrary 'id' parameter representing the notification to be deleted.\nBecause the application does not cross-reference the session-based user ID (retrieved from the authentication context) against the owner ID stored in the database for the targeted notification record, the system proceeds to execute the deletion command regardless of authorization.\nThe attack flow proceeds as follows: First, an authenticated attacker intercepts a legitimate notification deletion request or constructs a custom HTTP DELETE request targeting /anyone/extendNotice/deleteMyNotice. Second, the attacker increments or specifies arbitrary notification ID values within the payload or URI parameters. Third, the backend receives the request and, assuming the requester is authorized to delete the object, executes a database deletion operation using the provided ID. Finally, the server acknowledges the deletion of the record, even if the notification belongs to a different user, resulting in a successful bypass of object-level security controls.\nThis vulnerability persists in all versions up to and including 5.10.0. The lack of proper resource ownership validation represents a significant security oversight, enabling attackers to perform mass-deletion of notification data, which can be leveraged for denial-of-service against user alerts or to facilitate targeted disruption of platform communications.\nThe attack requires network access to the application API and a valid, non-expired authentication token. Since the application does not perform an identity-to-resource mapping, the scope of the impact is limited only by the range of valid notification IDs present in the underlying data store."
}