CVE-2026-92600CWE-862broken-access-control

CVE-2026-92600

Medium · published September 16, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00422 · 35.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-16T21:18Z
References (5)
https://github.com/stylefeng/Guns · [email protected]https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119 · [email protected]https://github.com/stylefeng/Guns/issues/118 · [email protected]https://repo1.maven.org/maven2/com/javaguns/roses/system-business-hr/8.3.5/system-business-hr-8.3.5-sources.jar · [email protected]https://www.vulncheck.com/advisories/guns-through-8.3.5-information-disclosure-via-missing-permission-check · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 16:03Z
    Guns through 8.3.5 Information Disclosure via Missing Permission Check
    cvelistv5