CVE-2026-94535

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1

Description An authorization bypass exists that allows authenticated users to delete notifications belonging to other users. This occurs because the system fails to validate the recipient when processing requests. An attacker can exploit this by calling the 'DELETE /anyone/extendNotice/deleteMyNotice' endpoint using arbitrary notice IDs.

Recommendations Update lamp-cloud to version 5.10.1 or later. As a temporary mitigation, restrict access to the 'DELETE /anyone/extendNotice/deleteMyNotice' endpoint.