Junglewise Threat Intelligence

CVE-2026-92600: Guns SysUserController information disclosure via missing RBAC validation

CVE-2026-92600 · Severity: medium · CVSS 6.5 · Published 2026-09-16

Executive brief

Guns is a modern Java application development framework. This vulnerability allows any authenticated user to retrieve sensitive information about all system users (names, email addresses, phone numbers, IP addresses, and role assignments) because two API endpoints fail to enforce proper access controls, bypassing role-based permission checks that should restrict this data.

Technical details

Guns versions through 8.3.5 contain an authorization bypass in the SysUserController affecting the /sysUser/detail and /sysUser/page endpoints. The vulnerability stems from missing requiredPermission configuration on these endpoints, causing the TokenAndPermissionInterceptor to skip RBAC validation despite the user holding a valid authentication token. An authenticated attacker can call these endpoints without proper authorization to enumerate user accounts and extract sensitive personally identifiable information (PII) including email, phone, and role assignments. Patched versions should restore permission decorators or explicit authorization checks on these endpoints.

Affected products

  • stylefeng Guns through 8.3.5

Timeline

  • 2026-09-16: disclosed

References

Related threats