EUVD-2026-19007Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The risk profile is elevated despite the moderate CVSS 4.3 score due to several compounding factors. CVSS signals indicate low attack complexity (AC:L) and network accessibility (AV:N), meaning any networked attacker can exploit this remotely; however, it requires PR:L (low-privilege authentication), limiting the immediate attack surface to users with legitimate system access. The CVSS Environmental score E:P (Proof of Concept Available) and RC:R (Reasonable Confidence) validate that real exploit code exists and the vulnerability is reliable. Critically, the vendor (Dromara) has not responded to early disclosure according to the description, suggesting patches may be unavailable. The publicly available exploit code transforms this from a theoretical risk into an operational threat. From an SSVC perspective, exploitation status is confirmed (POC exists), the attack is automatable (low complexity), and the technical impact is modest (information disclosure only), placing this in the medium-priority remediation range rather than critical. Organizations with users having authentication access to lamp-cloud instances face direct exploitation risk. |
| Exploit ScenarioDerived | An authenticated user or compromised low-privilege account holder logs into the lamp-cloud application and crafts a request to /defUser/pageUser with manipulated parameters designed to bypass authorization checks. The attack is straightforward to execute due to low complexity (AC:L) and publicly available exploit code from the GitHub issue report (https://github.com/dromara/lamp-cloud/issues/403), allowing the attacker to retrieve user data beyond their authorized scope. No special interaction or high-complexity exploitation is required, making this a practical attack vector for insiders or attackers with stolen credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 05, 2026
Improper authorization in Dromara lamp-cloud up to version 5.8.1 allows authenticated remote attackers to bypass access controls in the DefUserController pageUser endpoint, gaining unauthorized read access to sensitive user information. The CVSS score of 4.3 reflects low confidentiality impact with network accessibility and low attack complexity; however, public exploit code availability and vendor non-responsiveness increase real-world risk despite the modest base score.
RemediationAI
Upgrade Dromara lamp-cloud to a version newer than 5.8.1 immediately; however, no specific patched version has been confirmed from vendor communication as the project has not responded to early disclosure. Monitor the official Dromara lamp-cloud GitHub repository (https://github.com/dromara/lamp-cloud) and VulDB (https://vuldb.com/vuln/355282) for vendor-released patches. In the interim, implement network-level access restrictions to the /defUser/pageUser endpoint, restrict authentication tokens to users requiring pageUser functionality, and audit access logs for suspicious requests to this endpoint. Consider applying a Web Application Firewall rule to block parameter manipulation attempts targeting the pageUser function. This vulnerability requires authenticated access (PR:L), so review user authentication credentials and disable unnecessary service accounts with lamp-cloud access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an authorization bypass (CWE-285: Improper Authorization) in the DefUserController class, specifically in the pageUser function exposed at /defUser/pageUser. The attack involves manipulation of request parameters that circumvent role-based or attribute-based access control checks, allowing authenticated users to access data beyond their intended privilege level. The vulnerability affects the Dromara lamp-cloud application, a cloud-based service management platform built on Spring Boot architecture. The affected versions include all releases up to and including 5.8.1, with the CPE cpe:2.3:a:dromara:lamp-cloud:*:*:*:*:*:*:*:* indicating the entire product line is potentially vulnerable.
Know when Lamp Cloud gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component DefUserController. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Lamp Cloud
View allRemote code execution in LAMP Rapid Development Platform (dromara lamp-cloud) through version 5.6.2 allows low-privilege
Unauthenticated information disclosure in Dromara lamp-cloud through 5.10.0 stems from an overly broad anonymous-access
Authenticated profile tampering in dromara lamp-cloud through 5.10.0 lets any logged-in user overwrite other users' prof
Authenticated users of lamp-cloud (dromara/lamp-cloud) through version 5.10.0 can permanently delete notifications belon
Authenticated users of Dromara lamp-cloud through 5.10.0 can download other users' stored attachments by supplying a val
Authenticated users on any Dromara lamp-cloud deployment up to and including 5.10.0 can read the complete profile of eve
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json
Authenticated users of lamp-cloud through 5.10.0 can read any other employee's role codes, permission codes, and full fr
Server-side template injection (SSTI) in Dromara lamp-cloud versions 5.6.0 through 5.6.2 exposes the Message Template Ha
Exploit-DB