Skip to main content

Lamp Cloud CVE-2026-91996

| EUVDEUVD-2026-78436 HIGH
Missing Authentication for Critical Function (CWE-306)
2026-09-15 VulnCheck GHSA-8h63-cr94-gg65
Authentication Bypass Lamp Cloud Dromara
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
POC Analysis Generated
Sep 15, 2026 - 15:21 vuln.today
Analysis Generated
Sep 15, 2026 - 12:05 vuln.today
CVE Published
Sep 15, 2026 - 11:35 cve.org
HIGH 8.7

DescriptionCVE.org

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

AnalysisAI

Unauthenticated information disclosure in Dromara lamp-cloud through 5.10.0 stems from an overly broad anonymous-access whitelist pattern (/*/anno/) that exposes the /defGenProject/anno/getProperties endpoint. Any remote attacker who can reach the service via HTTP can POST to that path and receive the server's complete JVM system property map, leaking classpath entries, filesystem paths, OS build details, and startup secrets injected as properties. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Lamp Cloud

View all
CVE-2026-69100 HIGH POC
8.7 Aug 04

Remote code execution in LAMP Rapid Development Platform (dromara lamp-cloud) through version 5.6.2 allows low-privilege
CVE-2023-31579 CRITICAL
9.8 Nov 02

Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json

CVE-2026-9498 LOW POC
2.1 May 25

Server-side template injection (SSTI) in Dromara lamp-cloud versions 5.6.0 through 5.6.2 exposes the Message Template Ha
CVE-2026-5529 LOW POC
2.1 Apr 05

Improper authorization in Dromara lamp-cloud up to version 5.8.1 allows authenticated remote attackers to bypass access

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-91996 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy