Executive brief
Dromara lamp-cloud is a microservices development platform used to build multi-tenant business applications. A security flaw in the user management component allows a standard user to view sensitive profile information of users belonging to other organizations or companies. This could lead to the exposure of administrator account details and other private user data across the entire platform.
Technical details
An improper authorization vulnerability (CWE-285/CWE-266) exists in the `pageUser` function of `DefUserController` within Dromara lamp-cloud up to version 5.8.1. The root cause is a failure to implement row-level data scope filtering in the `DefUserMapper.xml` SQL query. While the system performs endpoint-level authentication, it lacks predicates to restrict results based on the caller's organization or company ID. A remote attacker with basic authenticated access can exploit this by sending a POST request to `/defUser/pageUser` with an empty model, allowing them to enumerate all users in the system, including high-privilege administrative accounts from other tenants. As of the advisory date, no official patch has been released.
Affected products
- Dromara lamp-cloud up to 5.8.1
Timeline
- 2026-03-18: disclosed: Issue reported to the project maintainers on GitHub
- 2026-04-05: advisory: CVE published via VulDB/NVD