Is CVE-2026-5529 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5529 being exploited in the wild.

How severe is CVE-2026-5529?

Medium severity, with a CVSS score of 4.3, published 5 April 2026.

Which products and versions are affected?

Dromara Lamp-Cloud up to 5.8.1.

Is there a fix for CVE-2026-5529?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5529 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-5529?

Check whether you run Dromara Lamp-Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5529: Dromara lamp-cloud improper authorization in DefUserController

CVE-2026-5529 · Severity: medium · CVSS 4.3 · Published 2026-04-05

Dromara lamp-cloud is a microservices development platform used to build multi-tenant business applications. A security flaw in the user management component allows a standard user to view sensitive profile information of users belonging to other organizations or companies. This could lead to the exposure of administrator account details and other private user data across the entire platform.

Technologies: Dromara Lamp-Cloud. Vendors: Dromara.

Quick answers

Is CVE-2026-5529 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5529 being exploited in the wild.
How severe is CVE-2026-5529?: Medium severity, with a CVSS score of 4.3, published 5 April 2026.
Which products and versions are affected?: Dromara Lamp-Cloud up to 5.8.1.
Is there a fix for CVE-2026-5529?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5529 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-5529?: Check whether you run Dromara Lamp-Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-285/CWE-266) exists in the `pageUser` function of `DefUserController` within Dromara lamp-cloud up to version 5.8.1. The root cause is a failure to implement row-level data scope filtering in the `DefUserMapper.xml` SQL query. While the system performs endpoint-level authentication, it lacks predicates to restrict results based on the caller's organization or company ID. A remote attacker with basic authenticated access can exploit this by sending a POST request to `/defUser/pageUser` with an empty model, allowing them to enumerate all users in the system, including high-privilege administrative accounts from other tenants. As of the advisory date, no official patch has been released.

Affected products

Dromara lamp-cloud up to 5.8.1

Timeline

2026-03-18: disclosed: Issue reported to the project maintainers on GitHub
2026-04-05: advisory: CVE published via VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.