CVE-2026-94535

🗓️ 21 Sep 2026 21:28:14Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 22 Views🌐 WEB

Auth bypass in lamp-cloud deleteMyNotice lets authenticated users delete other users' notifications.

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2026-94535	6 Oct 202611:20	–	circl
Cvelist	CVE-2026-94535 lamp-cloud through 5.10.0 Unauthorized Notification Deletion	21 Sep 202621:28	–	cvelist
EUVD	EUVD-2026-84209	22 Sep 202600:30	–	euvd
NVD	CVE-2026-94535	21 Sep 202622:17	–	nvd
Positive Technologies	PT-2026-96309	21 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-94535: Authorization Bypass Through User-Controlled Key	21 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-94535 lamp-cloud through 5.10.0 Unauthorized Notification Deletion	21 Sep 202621:28	–	vulnrichment

Vulners

CNA

Node

dromara lamp-cloudRange0–5.10.0

[
  {
    "vendor": "dromara",
    "product": "lamp-cloud",
    "packageURL": "pkg:github/dromara/lamp-cloud",
    "repo": "https://github.com/dromara/lamp-cloud",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "5.10.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-notification-deletion
github	www.github.com/dromara/lamp-cloud
github	www.github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-04-anyone-notice-delete-bola.py
github	www.github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-base/lamp-base-biz/src/main/java/top/tangyh/lamp/msg/service/impl/ExtendNoticeServiceImpl.java

Parameter	Position	Path	Description	CWE
notice_id	request body	/anyone/extendNotice/deleteMyNotice	Authorization bypass: authenticated user can delete other users' notifications by providing arbitrary notice IDs to the deleteMyNotice endpoint.	CWE-639

22 Sep 2026 20:53Current

6Medium risk

Vulners AI Score6

CVSS 3.17.1

CVSS 47.1

EPSS0.00467

SSVC

CWE-639