CVE-2026-92600 Details
Description
Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.
An information disclosure vulnerability exists in Guns versions through 8.3.5 within the SysUserController. The vulnerability arises because the '/sysUser/detail' and '/sysUser/page' endpoints do not include the requiredPermission configuration. This omission causes the permission interceptor to bypass Role-Based Access Control (RBAC) validation for authenticated users. As a result, attackers with any valid login token can access sensitive user information, such as account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/stylefeng/Guns | [email protected] | Vendor |
| https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119 | [email protected] | Source CodeVendor |
| https://github.com/stylefeng/Guns/issues/118 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://repo1.maven.org/maven2/com/javaguns/roses/system-business-hr/8.3.5/system-business-hr-8.3.5-sources.jar | [email protected] | Broken LinkSource CodeVendor |
| https://www.vulncheck.com/advisories/guns-through-8.3.5-information-disclosure-via-missing-permission-check | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| stylefeng Guns | <= 8.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |