CVE-2026-90594 Details
Description
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
An authorization bypass vulnerability has been identified in wxiaoqi Spring-Cloud-Platform versions 3.0.1 and 3.1.0. The issue resides in the Permission Service component, specifically within the checkUserPermission function of PermissionService.java. This vulnerability allows missing authorization for API endpoints that are not explicitly registered in the permission database. The gateway's default behavior is to treat unregistered routes as public, enabling unauthorized access to various sensitive operations. Remote exploitation is possible, and a public exploit is available.
To address this vulnerability, the default permission check should be changed from a fail-open to a fail-closed model, denying access to unregistered routes by default.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 13, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/user-attachments/files/30627348/poc_vuln1_failopen_authz.zip | [email protected] | Broken LinkExploit |
| https://github.com/wxiaoqi/Spring-Cloud-Platform/ | [email protected] | ProductVendor |
| https://github.com/wxiaoqi/Spring-Cloud-Platform/issues/64 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-90594 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/913788 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403176 | [email protected] | Content Wall |
| https://vuldb.com/vuln/403176/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wxiaoqi Spring-Cloud-Platform | 3.0.1 (semver) 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 13, 2026 | New CVE Received | [email protected] |