Zuihou Lamp-boot vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Zuihou Lamp-boot: 1 record(s), with affected versions and fixes.

CVE-2026-110763 Medium · 4.3 CWE-639 Oct 14, 2026

lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.