{"id":"CVE-2026-110763","summary":"lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany","details":"lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.","modified":"2026-10-17T02:48:18.847713315Z","published":"2026-10-14T18:47:39.046Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110763.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110763.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110763"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/lamp-boot-4.16.0-java17-through-4.21.2-java17-idor-via-anyone-finddeptbycompany"},{"type":"PACKAGE","url":"https://github.com/zuihou/lamp-boot"},{"type":"ARTICLE","url":"https://github.com/zuihou/lamp-boot/blob/ddef8c71de970b915ba1b15e0e9c2dd7414074de/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L167"},{"type":"EVIDENCE","url":"https://hackmd.io/@hieuPenguinnn/lamp-boot-finddeptbycompany-employee-idor"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zuihou/lamp-boot","events":[{"introduced":"0"},{"fixed":"9c945c87a0399c88e3778bf5a907975157d9ba04"}],"database_specific":{"extracted_events":[{"introduced":"4.16.0-java17"},{"last_affected":"4.21.2-java17"},{"fixed":"4.21.2-java17"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["4.18.0-java17","4.17.0-java17","3.8.1","3.7.0","3.6.2","3.6.0","3.5.8","3.5.5","3.5.4","3.5.3","3.5.2","3.5.1","3.5.0","3.4.0","3.3.0","3.2.4","3.2.2","3.2.1","3.2.0","3.1.2","3.1.0","3.0.2","3.0.1","3.0.0","2.7.0","2.6.0","2.5.2","2.5.0","2.4.0","2.3","2.2","2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110763.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}