CVE-2026-110763 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in the lamp-boot framework, specifically in versions 4.16.0-java17 through 4.21.2-java17. The issue resides within the OAuth module's '/anyone/findDeptByCompany' endpoint, which bypasses URI permission checks. This vulnerability enables authenticated low-privilege users to manipulate employee ID values and access department membership information for all employees within the same tenant.

The recommended remediation is to remove the employee ID parameter from the 'findDeptByCompany' method and instead retrieve the employee ID from the session context. This would ensure that the endpoint only returns department information for the authenticated user. If cross-employee queries are necessary, they should be gated behind a specific permission check.