CVE-2026-110763

A flaw was found in lamp-boot. The oauth module's /anyone/findDeptByCompany endpoint fails to properly enforce access permission checks, resulting in an insecure direct object reference IDOR vulnerability. An authenticated attacker with low privileges can exploit this flaw by submitting sequentia...

CVE-2026-110763

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110763

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110763

The lamp-boot framework (versions 4.16.0-java17 through 4.21.2-java17 ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the oauth module . The issue exists in the /anyone/findDeptByCompany endpoint, which fails to perform proper URI permission checks. This flaw allows aut...

CVE-2026-110763 lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110763 lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

EUVD-2026-101563

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110763 lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110763: Authorization Bypass Through User-Controlled Key

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

PT-2026-114127

Name of the Vulnerable Software and Affected Versions lamp-boot versions 4.16.0-java17 through 4.21.2-java17 Description An insecure direct object reference issue exists in the oauth module's '/anyone/findDeptByCompany' endpoint. The system fails to perform URI permission checks, allowing...