The exposed /anyone/findDeptByCompany endpoint in the lamp-boot OAuth module does not enforce URI permission checks, exposing an insecure direct object reference. Authenticated low‑privilege accounts can supply sequential employeeId values to retrieve the department membership of any employee within the same tenant. This allows a malicious insider or a user with compromised credentials to uncover organizational structure and potentially sensitive employee affiliations, violating confidentiality.

The vulnerability affects the lamp-boot product from zuihou, specifically versions 4.16.0‑java17 through 4.21.2‑java17. No other product or version ranges are indicated.

The CVSS score of 5.3 reflects moderate severity. Exploitation requires an authenticated low‑privilege user; the attacker may need legitimate credentials or a compromised account, limiting the use to internal or insider threats. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited in the wild.