Is CVE-2026-94535 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-94535?

CVE-2026-94535 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-94535

Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.