Executive brief
Guns is a Java application development framework widely used for building business systems. An access control flaw in the system notices feature allows authenticated users without proper role assignments to create, modify, delete, and publish notices that affect all users and departments, potentially disrupting communications and operations.
Technical details
The vulnerability is an improper access control flaw in the SysNoticeController component where the requiredPermission setting defaults to false and is never overridden by specific action methods. This means permission checks are bypassed for notice creation, editing, deletion, publishing, and retraction operations. Any authenticated user—even without assigned roles—can exploit this to manipulate system-wide notices. The attack requires only valid authentication credentials and network access to the application; no additional privilege escalation is needed. A patch or configuration override is required to enforce proper role-based access controls on these operations.
Affected products
- stylefeng Guns through 8.3.5
Timeline
- 2026-09-16: disclosed