Vulnerability Description
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/stylefeng/Guns
- https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/
- https://github.com/stylefeng/Guns/issues/119
- https://repo1.maven.org/maven2/com/javaguns/roses/system-business-portal/8.3.5/s
- https://www.vulncheck.com/advisories/guns-through-8.3.5-improper-access-control-
- https://github.com/stylefeng/Guns/issues/119
FAQ
What is CVE-2026-92601?
CVE-2026-92601 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users ...
How severe is CVE-2026-92601?
CVE-2026-92601 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92601?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.