Executive brief
Guns is a modern Java application development framework. This vulnerability allows any authenticated user to retrieve sensitive information about all system users (names, email addresses, phone numbers, IP addresses, and role assignments) because two API endpoints fail to enforce proper access controls, bypassing role-based permission checks that should restrict this data.
Technical details
Guns versions through 8.3.5 contain an authorization bypass in the SysUserController affecting the /sysUser/detail and /sysUser/page endpoints. The vulnerability stems from missing requiredPermission configuration on these endpoints, causing the TokenAndPermissionInterceptor to skip RBAC validation despite the user holding a valid authentication token. An authenticated attacker can call these endpoints without proper authorization to enumerate user accounts and extract sensitive personally identifiable information (PII) including email, phone, and role assignments. Patched versions should restore permission decorators or explicit authorization checks on these endpoints.
Affected products
- stylefeng Guns through 8.3.5
Timeline
- 2026-09-16: disclosed