CVE-2026-5529
MEDIUMDromara lamp-cloud DefUserController pageUser improper authorization
Title source: cnaDescription
A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component DefUserController. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References (5)
Scores
CVSS v3
4.3
EPSS
0.0001
EPSS Percentile
1.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-266
CWE-285
Status
published
Products (2)
Dromara/lamp-cloud
5.8.0
Dromara/lamp-cloud
5.8.1
Published
Apr 05, 2026
Tracked Since
Apr 05, 2026