MEDIUM
zuihou
CVE published 2026-10-14
CVE-2026-110763
Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant. This insecure direct object reference vulnerability in lamp-boot 4.16.0-java17 through 4.21.2-java17's oauth module's /anyone/findDeptByCompany endpoint allows unauthorized access to sensitive employee information. Defenders should assess their exposure and prioritiz [truncated]