CVE-2026-94534

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1

Description The software fails to validate user identity in the 'PUT /anyone/baseInfo' and 'PUT /anyone/avatar' endpoints. This allows authenticated attackers to modify arbitrary user profiles by supplying target user IDs in the request bodies. Affected profile fields include nickname, ID card, sex, nation, education, work description, and avatar attachments.

Recommendations Update lamp-cloud to a version newer than 5.10.0. Restrict access to the 'PUT /anyone/baseInfo' and 'PUT /anyone/avatar' endpoints to minimize the risk of exploitation.