CVE-2026-110763
Description
A flaw was found in lamp-boot. The oauth module's /anyone/findDeptByCompany endpoint fails to properly enforce access permission checks, resulting in an insecure direct object reference (IDOR) vulnerability. An authenticated attacker with low privileges can exploit this flaw by submitting sequential employee identifiers to the endpoint. Successful exploitation results in information disclosure, allowing the attacker to view tenant-wide employee department membership records without authorization.
Statement
Red Hat Product Security rates the severity of this vulnerability as Moderate because exploitation is restricted to reading tenant organizational structures and cannot alter data or grant system-level privileges. Exploitation requires existing authenticated access to query sequential identifiers, limiting the overall blast radius to partial confidentiality loss. Furthermore, lamp-boot is not included or supported in Red Hat products, leaving enterprise environments unaffected by default.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
