Executive brief
lamp-cloud is a microservices backend development platform. An authenticated attacker can bypass authorization checks in the /anyone/visible/resource endpoint by supplying arbitrary employee IDs, allowing them to enumerate any employee's roles, permissions, and interface structure. This enables reconnaissance for privilege escalation and lateral movement attacks within the organization.
Technical details
The vulnerability is a broken object-level authorization (BOLA) flaw in the ResourceController.visible() endpoint. The endpoint accepts an unauthenticated employeeId parameter that takes precedence over the authenticated user's own ID, with no authorization check; attackers can iterate employeeId values to extract role codes, resource/permission codes, and router trees for any employee in the system.
Affected products
- dromara lamp-cloud through 5.10.0
Timeline
- 2026-09-21: disclosed: Vulnerability disclosed on NVD