CVE-2026-94536

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1

Description Authenticated users can read the roles and permissions of any employee because the application fails to validate the employeeId parameter in the '/anyone/visible/resource' endpoint. This allows attackers to provide arbitrary employeeId values to enumerate role codes, permission codes, and complete front-end router trees without proper authorization checks.

Recommendations Update lamp-cloud to a version newer than 5.10.0. As a temporary workaround, restrict access to the '/anyone/visible/resource' endpoint or avoid using the employeeId parameter until the update is applied.