CVE-2026-90595 Details

A security vulnerability exists in wxiaoqi Spring-Cloud-Platform versions 1.0, 2.2, and 3.0. The issue is located in the OnlineController, specifically within the getOnlineInfo function. This vulnerability allows for missing authorization, enabling any authenticated user to access session management endpoints without proper authorization checks. As a result, attackers can enumerate active sessions, including those of administrators, and forcefully log out any user by deleting their session from Redis. The vulnerability can be exploited remotely, and a proof-of-concept exploit has been made public.

To address this vulnerability, it is recommended to add method-level authorization checks to the OnlineController endpoints, ensuring that only users with the appropriate roles can access them. Additionally, implement ownership verification for session deletion requests and enable global method security in the ace-admin module.