CVE-2026-94534 lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
Authenticated attackers can modify arbitrary user profiles by supplying target user IDs to unvalidated PUT endpoints in lamp-cloud.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94534?
CVE-2026-94534 is a high-severity missing authorization vulnerability in dromara lamp-cloud, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.
Weakness: CWE-639
Which versions are affected by CVE-2026-94534?
How do I fix CVE-2026-94534?
No fix has been published for CVE-2026-94534 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-94534 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-94534 exists.
Sources
Also known as GHSA-fp33-7f49-fwpm.