https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 13:01:33 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110763 <p>lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module&#39;s /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee&#39;s department membership within the tenant.</p> <p>lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module&#39;s /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee&#39;s department membership within the tenant.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110763 https://db.gcve.eu/vuln/ghsa-9cq5-3v6h-r7pm <p>lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module&#39;s /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee&#39;s department membership within the tenant.</p> <p>lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module&#39;s /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee&#39;s department membership within the tenant.</p> https://db.gcve.eu/vuln/ghsa-9cq5-3v6h-r7pm