An authorization bypass vulnerability in dromara lamp-cloud allows any authenticated user to harvest sensitive personal information from other users, posing a significant data privacy risk.

The vulnerability is a Broken Object Level Authorization (BOLA) flaw (CWE-639) located in the getUserInfoById endpoint. The application fails to verify ownership of the requested user ID, allowing any logged-in user to retrieve the profile data of any other user by supplying an arbitrary userId parameter.

The exploitation of this flaw leads to unauthorized disclosure of sensitive personally identifiable information (PII), including mobile numbers, email addresses, national identity card numbers, and third-party platform OpenIDs. Given the CVSS score of 6.5, this vulnerability represents a significant risk to user privacy and regulatory compliance. Unauthorized access to this data could facilitate further targeted social engineering attacks, identity theft, or reputational damage to the organization.

Immediate Action: Update dromara lamp-cloud to a version beyond 5.10.0 that includes the necessary authorization checks on the getUserInfoById endpoint.

Proactive Monitoring: Review application access logs for anomalous patterns, such as a single user account requesting a high volume of distinct user profiles in a short timeframe.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API gateway rules to restrict access to the /anyone/getUserInfoById endpoint or to enforce stricter validation on the userId parameter if patching is delayed.

Public Exploit Available: Yes, a proof-of-concept script has been published by a security researcher on GitHub.

This vulnerability presents a clear risk of PII leakage that can be exploited with minimal technical effort. Organizations should prioritize updating their lamp-cloud deployment to a patched version immediately. If an immediate update is not feasible, implement strict access controls or rate limiting on the affected endpoint to prevent automated harvesting of user data.