CVE-2026-110763 — lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI …
Published: 2026-10-14 · CVSS: 5.3 · CVSS 4.0
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7