Lamp Cloud EUVD-2026-84210

Requires a valid authenticated account on the target lamp-cloud instance (PR:L); any low-privilege user suffices. The specific prerequisite is access to the /anyone/visible/resource endpoint, which fails to validate that the supplied employeeId belongs to the requesting user, so the attacker only needs to supply arbitrary employeeId values (trivially enumerable integers) to read other employees' roles, permission codes, and router trees. No user interaction, no special non-default configuration, and no elevated privileges are needed; the limiting factor is solely possession of any authenticated session and network reachability to the lamp-cloud OAuth service. Impact is confined to read-only disclosure of authorization metadata.

This is a genuine but low-severity authorization flaw (CWE-639 IDOR/BOLA), and the CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately captures it: network-reachable, low complexity, but requiring an authenticated account (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. The impact is information disclosure of authorization metadata - role codes, permission codes, and front-end router trees for arbitrary employees - not credential theft or data modification, so the C:L rating is appropriate rather than understated. A public POC exists (LinYuanyi1 poc-05), which raises practical exploitability, but POC availability is distinct from active exploitation: there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of widespread real-world targeting. The signals are internally consistent (no CVSS-vs-description conflict), and the realistic priority is LOW-to-MODERATE - a straightforward enumeration bug that leaks organizational RBAC structure useful for reconnaissance/privilege-mapping ahead of a broader attack, but not directly impactful on its own. Note the input tag 'Authentication Bypass' is misleading: this is an authorization (access-control) failure, not an authentication bypass, since a valid session is required.

An authenticated low-privilege user of a lamp-cloud deployment calls GET /anyone/visible/resource while substituting other employees' IDs into the employeeId parameter, receiving each target's role codes, permission codes, and full front-end router tree without any ownership check. A public Python POC (poc-05) automates iterating employeeId values to harvest the entire organization's RBAC layout. Because the CVSS vector is AV:N/AC:L/PR:L with no user interaction, exploitation is a trivial scripted enumeration once any account is obtained.