---
id: CVE-2026-94534
title: >-
  lamp-cloud through 5.10.0 fails to validate user identity in PUT
  /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated
  attackers to modify arbitrary user profiles
summary: >-
  lamp-cloud through 5.10.0 fails to validate user identity in PUT
  /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated
  attackers to modify arbitrary user profiles. Attackers can supply target user
  IDs in request bodie…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'
cwe:
  - CWE-639
vendor: dromara
product: lamp-cloud
affected:
  - lamp-cloud <= 5.10.0
published: '2026-09-21'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:53:07.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94534'
references:
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-03-anyone-baseinfo-write-bola.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-06-anyone-avatar-write-bola.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/dromara/lamp-cloud'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L128-L136
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L68-L78
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-profile-modification-via-put-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00486
epssPercentile: 0.39136
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T17:19:31.899024Z'
ingestedAt: '2026-09-21T21:53:57.427Z'
---

## Overview

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.