Description

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T22:17:00.640Z",
  "pubdate": "2026-09-21T22:17:00.640Z",
  "executiveSummary": "The lamp-cloud platform (versions through 5.10.0) contains an Insecure Direct Object Reference (IDOR) vulnerability within the /anyone/visible/resource endpoint. This flaw stems from a failure to validate the employeeId parameter, allowing authenticated users to access sensitive role and permission data belonging to other employees.\nBy manipulating the employeeId parameter, an attacker can perform unauthorized information disclosure, specifically enumerating arbitrary user roles, permission codes, and full front-end router tree structures. This vulnerability poses a significant risk to organizational confidentiality, as it enables lateral reconnaissance and the mapping of internal access control structures without requiring elevated privileges. The exploitation is restricted to authenticated users, but the lack of server-side authorization checks for the requested resource identifier makes the system highly susceptible to automated scraping and data enumeration attacks.",
  "technicalDetails": "The vulnerability resides in the /anyone/visible/resource endpoint of the lamp-cloud application, which fails to perform server-side validation of the employeeId input parameter. This represents a classic Insecure Direct Object Reference (IDOR) flaw where the application relies solely on the input provided by the client to determine the scope of data retrieval.\nThe attack flow begins with an authenticated user initiating a request to the /anyone/visible/resource endpoint. While the application validates that the user possesses a valid session, it fails to verify that the requesting user has the appropriate authorization to view the resource data associated with the submitted employeeId. By substituting the valid employeeId of another user with an arbitrary value, the attacker can traverse the user base and extract granular authorization metadata.\nThe technical impact involves the exposure of backend-driven security identifiers. The payload responses for the targeted employeeId include detailed role codes and permission codes, which provide the attacker with a clear understanding of the target's privilege level and access scope. Furthermore, the endpoint returns the complete front-end router tree, which exposes the entire application navigation structure. This data is critical for an attacker looking to identify restricted UI components or hidden administrative modules that might be susceptible to further exploitation.\nBecause the server lacks a cross-reference mechanism between the authenticated session identity and the requested employeeId, the application implicitly trusts the client's input. This allows for simple automation of requests using scripts or intercepting proxies to enumerate the permissions of all users within the system. The lack of authorization logic within the Controller or Service layer responsible for this endpoint means that any authenticated user can effectively bypass the intended access control policies, leading to a total failure of confidentiality regarding internal user roles and UI permissions."
}