CyberRota Analysis
AI-GeneratedThe deleteMyNotice endpoint in lamp-cloud versions up to 5.10.0 is vulnerable to an authorization bypass, allowing authenticated users to delete notifications belonging to other users by exploiting the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs. This flaw can lead to unauthorized data manipulation and loss of important notifications for users. Organizations using this software should prioritize patching to mitigate the risk of data breaches and maintain user trust.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.