CVE-2026-110763

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

EUVD-2026-101563

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110763 lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110763

The lamp-boot framework (versions 4.16.0-java17 through 4.21.2-java17 ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the oauth module . The issue exists in the /anyone/findDeptByCompany endpoint, which fails to perform proper URI permission checks. This flaw allows aut...