CVE-2026-110763
Beschrijving NL
lamp-boot 4.16.0-java17 tot en met 4.21.2-java17 bevat een onveilige kwetsbaarheid voor directe objectreferentie in het /anyone/findDeptByCompany-eindpunt van de oauth-module die URI-toestemmingscontroles overslaat. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.
Origineel (Engels) tonen
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.