CVE-2026-90595 in Spring-Cloud-Platform
Summary
by MITRE • 09/14/2026
A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified within wxiaoqi Spring-Cloud-Platform versions 1.0, 2.2, and 3.0 represents a critical failure in access control mechanisms, specifically residing in the OnlineController.getOnlineInfo function located at aceModules/ace-admin/auth/controller/OnlineController.java. This flaw is classified as an improper authorization issue where the application fails to verify that the requesting user has the necessary permissions to access specific resources or perform certain actions. In a properly secured system, any request to retrieve online information should be authenticated and authorized based on the user's role and privileges. However, due to this defect, the endpoint does not enforce these checks effectively, allowing unauthenticated or unauthorized users to interact with sensitive data endpoints that are intended for administrative use only.
From a technical perspective, the absence of authorization controls in the getOnlineInfo method means that any actor on the network can invoke this function without providing valid credentials or possessing elevated privileges. This type of vulnerability is commonly associated with CWE-284, which describes Improper Access Control, and often falls under the broader category of Broken Access Control as defined by OWASP Top 10 security risks. The lack of enforcement allows attackers to bypass standard authentication gates, effectively treating protected administrative endpoints as public resources. This misconfiguration undermines the fundamental principle of least privilege, granting users access beyond their assigned roles without any validation logic in place to restrict such actions.
The operational impact of this vulnerability is significant due to its remote exploitability and the nature of the data involved. Since the function deals with online information, it likely exposes details about currently logged-in users, including session identifiers, IP addresses, user IDs, or other metadata that can be leveraged for further attacks. An attacker could use this information to map out active sessions, identify high-value targets such as administrators who are currently online, and potentially facilitate targeted phishing campaigns or session hijacking attempts if additional weaknesses exist in the session management logic. The fact that an exploit has already been released publicly increases the immediacy of the threat landscape, making automated attacks against vulnerable instances highly probable for malicious actors scanning the internet for exposed administrative interfaces.
Furthermore, the situation is exacerbated by the vendor's lack of response to early issue reports regarding this problem. This delay in patching leaves a wide window of exposure during which systems running these versions remain susceptible to exploitation. Organizations relying on wxiaoqi Spring-Cloud-Platform must recognize that without an official security update from the provider, they are responsible for implementing compensating controls to mitigate risk until a fix is available or migration occurs. The public availability of exploits means that automated scanners and threat actors will actively seek out these specific endpoints, making proactive defense measures essential rather than optional.
To mitigate this vulnerability in the absence of an immediate vendor patch, administrators should implement network-level restrictions such as firewall rules to limit access to the affected endpoint exclusively from trusted internal IP addresses or administrative subnets. Additionally, deploying a Web Application Firewall with rule sets designed to detect and block unauthorized API calls can provide an additional layer of defense by inspecting request headers for missing authentication tokens or invalid session data. It is also advisable to review application logs for unusual access patterns to the OnlineController endpoint, which may indicate ongoing exploitation attempts. Long-term remediation requires upgrading to a patched version once released or refactoring the code to enforce strict role-based access control checks within the getOnlineInfo method before any business logic is executed.