This vulnerability arises from missing validation of the employeeId parameter in lamp‑cloud's /anyone/visible/resource endpoint. An authenticated user can specify arbitrary employee IDs and obtain the target employee's role codes, permission codes, and complete navigation tree. Because the resource exposes internal role and permission metadata, the defect leads to unauthorized disclosure of internal security structures, which can facilitate further attacks such as targeted privilege escalation. The weakness is an authorization bypass (CWE‑639).

The vulnerability affects the dromara lamp‑cloud application, versions up to and including 5.10.0. Systems running 5.10.0 or earlier are susceptible; later releases may have applied a fix.

With a CVSS score of 5.3, the issue presents moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. Attackers must first authenticate to the system, but otherwise no special privileges are required; the endpoint is publicly accessible to authenticated users. Once authenticated, an attacker can enumerate numerous employees' roles and permissions, revealing sensitive internal data that can support further compromise.