CVE-2026-92600 in Guns
Summary
by MITRE • 09/16/2026
Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Guns versions prior to 8.3.5 represents a critical failure in Role-Based Access Control implementation within the SysUserController component. Specifically, the endpoints /sysUser/detail and /sysUser/page lack the necessary requiredPermission configuration annotations or metadata that are typically processed by the framework's security interceptor chain. In standard Spring-based applications utilizing custom interceptors for authorization, these annotations serve as explicit signals to enforce access checks before controller logic executes. The absence of this configuration results in a bypass of the RBAC validation mechanism, effectively rendering authentication sufficient for accessing resources that should be restricted based on user roles or privileges.
From an operational perspective, this flaw allows any authenticated attacker with valid login credentials to enumerate sensitive personal and administrative data across the entire system. By exploiting these endpoints without needing elevated permissions, adversaries can retrieve comprehensive profiles of all users, including account names, real identities, email addresses, phone numbers, last known IP addresses, and assigned role assignments. This level of information disclosure significantly expands the attack surface by providing attackers with detailed intelligence that facilitates further social engineering attacks, targeted phishing campaigns, or credential stuffing attempts using verified contact details and internal organizational structures.
This vulnerability aligns closely with CWE-200, which categorizes exposure of sensitive information to an unauthorized actor, as well as CWE-862, the missing authorization check where access control logic is not enforced for a specific resource. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1078, Valid Accounts, as it relies on legitimate credentials but abuses misconfigured permissions rather than exploiting a software bug in authentication itself. It also relates to T1005, Data from Local System, specifically the sub-technique for data staged or collected via API endpoints that fail to enforce proper access controls.
Mitigation strategies must prioritize immediate patching of the Guns framework to version 8.3.5 or later where these permission configurations are correctly applied to the affected endpoints. For organizations unable to upgrade immediately, a temporary workaround involves configuring web server rules or reverse proxy settings to restrict direct API access to /sysUser/detail and /sysUser/page unless explicitly validated by an external authorization service. Additionally, security teams should audit other controller methods for similar omissions in permission annotations to prevent analogous bypasses across the application. Implementing strict input validation and ensuring that all sensitive endpoints are covered by comprehensive integration tests verifying RBAC enforcement is essential for long-term resilience against such configuration-based vulnerabilities.