CVE-2026-92601

EUVD-2026-80859
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/stylefeng/Guns
https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119
https://github.com/stylefeng/Guns/issues/119
https://repo1.maven.org/maven2/com/javaguns/roses/system-business-portal/8.3.5/system-business-portal-8.3.5-sources.jar
https://www.vulncheck.com/advisories/guns-through-8.3.5-improper-access-control-via-sysnoticecontroller
https://github.com/stylefeng/Guns/issues/119