lamp-boot EUVD-2026-101563

Requires a valid authenticated low-privilege user account within the target tenant (PR:L). The specific prerequisite is reaching the oauth module's /anyone/findDeptByCompany endpoint, which omits the URI permission check that should restrict access, combined with sequential/predictable employeeId values that permit enumeration. Limiting factors: exploitation is impossible without prior authentication, the impact is confined to reading employee department-membership data within a single tenant (confidentiality only - no modification or denial of service), and it affects only lamp-boot versions 4.16.0-java17 through 4.21.2-java17.

This is a genuine but low-to-moderate-severity authorization flaw, not a high-urgency emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N) scores 5.3 (medium) and is internally consistent with the description: network-reachable, low attack complexity, requires an authenticated low-privilege account (PR:L), and yields only a low confidentiality impact (VC:L) with no integrity or availability impact. No EPSS probability was supplied and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation. No explicit POC/exploit-code flag was provided in the input, though a public technical write-up (hackmd) and a VulnCheck advisory document the issue, lowering the research barrier for an attacker. The signals are consistent rather than conflicting: a medium-CVSS, authenticated, read-only IDOR affecting a niche open-source framework. Net real-world risk is limited - exploitation discloses only employee-to-department mappings within a single tenant and requires prior authentication - so this is a legitimate fix-in-normal-cycle item rather than a drop-everything priority. Note the input tag 'Authentication Bypass' is a misnomer: authentication is NOT bypassed (users are authenticated); the flaw is broken object-level authorization (CWE-639 IDOR).

A low-privilege but authenticated user inside a tenant calls the oauth module's /anyone/findDeptByCompany endpoint, which skips URI permission checks, and increments sequential employeeId values to enumerate the department membership of every employee in the tenant. A public technical write-up (hackmd) and VulnCheck advisory describe the flaw, but no weaponized exploit code was flagged in the input. Because the attack vector is network-based with low complexity, scripting the enumeration is trivial once a valid account is held.