CVE-2026-92601CWE-862broken-access-control

CVE-2026-92601

Medium · published September 16, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.8
In the wild
Unconfirmed
What it is

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00389 · 31.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-16T21:18Z
References (6)
https://github.com/stylefeng/Guns · [email protected]https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119 · [email protected]https://github.com/stylefeng/Guns/issues/119 · [email protected]https://repo1.maven.org/maven2/com/javaguns/roses/system-business-portal/8.3.5/system-business-portal-8.3.5-sources.jar · [email protected]https://www.vulncheck.com/advisories/guns-through-8.3.5-improper-access-control-via-sysnoticecontroller · [email protected]https://github.com/stylefeng/Guns/issues/119 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 16:03Z
    Guns through 8.3.5 Improper Access Control via SysNoticeController
    cvelistv5