Description
lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.
Published: 2026-09-21
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Unauthorized modification of arbitrary user profiles via authenticated endpoints
Action: Immediate Patch
AI Analysis

Impact

lamp‑cloud versions up to 5.10.0 lack identity validation on the PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, enabling an authenticated user to specify another user’s ID in the request body. This allows the attacker to rewrite profile fields such as nickname, ID card, sex, nation, education, work description and the avatar attachment, effectively compromising the integrity and privacy of other user accounts.

Affected Systems

The affected product is lamp‑cloud from dromara, specifically all releases through 5.10.0.

Risk and Exploitability

The vulnerability scores a CVSS of 7.1 indicating a medium‑high severity. No EPSS data is available and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is network‑based; an authenticated user merely needs to send a crafted HTTP PUT request to the vulnerable endpoints. The exploitation requires only valid authentication and no additional privileged access, making it relatively easy to exploit in an environment where the attacker has legitimate login credentials or can obtain them.

Generated by OpenCVE AI on September 21, 2026 at 22:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest lamp‑cloud update that corrects the identity validation for the PUT /anyone/baseInfo and PUT /anyone/avatar endpoints.
  • If a patch is unavailable, limit use of the PUT /anyone/* endpoints to users with administrator privileges or remove the endpoints entirely.
  • Configure a web application firewall or reverse proxy to reject PUT requests whose target user ID does not match the authenticated session user.
  • Restrict network exposure of these endpoints to trusted IP addresses or internal networks.

Generated by OpenCVE AI on September 21, 2026 at 22:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Description lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.
Title lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
First Time appeared Tangyh
Tangyh lamp-cloud
Weaknesses CWE-639
CPEs cpe:2.3:a:tangyh:lamp-cloud:*:*:*:*:*:*:*:*
Vendors & Products Tangyh
Tangyh lamp-cloud
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Tangyh Lamp-cloud
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-21T21:28:13.569Z

Reserved: 2026-09-21T18:25:18.522Z

Link: CVE-2026-94534

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T22:17:00.327

Modified: 2026-09-21T22:17:00.327

Link: CVE-2026-94534

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T23:00:12Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key