CVE-2026-110763 zuihou CVE debrief

Who should care

Defenders and administrators of systems using lamp-boot 4.16.0-java17 through 4.21.2-java17 should assess their exposure and take necessary actions to mitigate the vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Prioritization is crucial, especially in systems where low-privilege users have access to sensitive information.

Why it matters

This vulnerability allows authenticated low-privilege users to access sensitive employee information, potentially leading to data breaches and unauthorized access. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where low-privilege users have access to sensitive information.

• Potential unauthorized access to sensitive employee information
• Possible data breaches due to insecure direct object reference
• Need for additional monitoring and logging to detect potential exploitation attempts
• Requirement for prompt patching or mitigation to prevent exploitation

Technical summary

The lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint. This vulnerability allows authenticated low-privilege users to iterate sequential employeeId values to read every employee's department membership within the tenant. The vulnerability can lead to unauthorized access to sensitive employee information and potential data breaches. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where low-privilege users have access to sensitive information.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where low-privilege users have access to sensitive information.

Recommended defensive actions

• Verify the vulnerability exists in your system
• Restrict access to the /anyone/findDeptByCompany endpoint
• Implement proper authorization checks
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the insecure direct object reference vulnerability in lamp-boot 4.16.0-java17 through 4.21.2-java17. Evidence is limited to CVE Program and supplemental source information. Defenders should verify the vulnerability exists in their system and review official advisories for affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.