Vulnerability · Published Sep 21, 2026 · Assigned by VulnCheck

CVE-2026-94534lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in lamp-cloud from dromara. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.5%top 58.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.

Affected products (as reported)

Vendor	Product	Versions
dromara	lamp-cloud	0 – through 5.10.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

Proof of concept, profile overwrite exploit
Proof of concept, avatar overwrite exploit
Vulnerable code, avatar technical-description
Vulnerable code, baseInfo technical-description
https://github.com/dromara/lamp-cloud product
VulnCheck Advisory: lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints third-party-advisory