CVE-2026-94535lamp-cloud through 5.10.0 Unauthorized Notification Deletion

Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• Proof of concept exploit
• Vulnerable code technical-description
• https://github.com/dromara/lamp-cloud product
• VulnCheck Advisory: lamp-cloud through 5.10.0 Unauthorized Notification Deletion third-party-advisory