CVE-2026-94532

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1

Description An authorization bypass exists in the 'getUserInfoById' endpoint. This flaw allows authenticated users to access the full profiles of other users by iterating the userId parameter. This can lead to the harvesting of sensitive data, including email addresses, mobile numbers, national identity card numbers, and OpenIDs for WeChat and DingTalk.

Recommendations Update lamp-cloud to a version newer than 5.10.0. As a temporary mitigation, restrict access to the 'getUserInfoById' endpoint or monitor the userId parameter for unusual iteration patterns.