CVE-2026-5529Medium· 4.3▾ Sunlit

A vulnerability was detected in Dromara lamp-cloud up to 5.8.1

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score24/ 100 · Low

impact 23.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Apr 5, 2026

Updated

Jul 24, 2026

CVSS

4.3

Vendor

—

Product

—

CWE

CWE-266, CWE-285

Depth score

24 · Low

EPSS

0.27% · p20

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 31.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 173 days

Apr 5, 2026Published
Disclosed via NVD
Jul 24, 2026Record revised
Last analysed / modified upstream
Jul 31, 2026EPSS first tracked
0.3%
Sep 25, 2026EPSS peak
0.3% → 0.3%

CWE-266 CWE-285 #nvd

Full technical detail▾

Overview

A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component DefUserController. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed