Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by stylefeng
CVE-2026-92601 (GCVE-0-2026-92601)
Vulnerability from nvd – Published: 2026-09-16 16:03 – Updated: 2026-09-16 17:27
VLAI
EPSS
VEX
Title
Guns through 8.3.5 Improper Access Control via SysNoticeController
Summary
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:26 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/stylefeng/Guns/issues/119 | issue-tracking |
| https://github.com/stylefeng/Guns | product |
| https://github.com/stylefeng/Guns/blob/2a12947733… | technical-description |
| https://repo1.maven.org/maven2/com/javaguns/roses… | technical-description |
| https://www.vulncheck.com/advisories/guns-through… | third-party-advisory |
Date Public
2026-06-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92601",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:26:21.178070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:27:01.781Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/stylefeng/Guns/issues/119"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/stylefeng/Guns",
"defaultStatus": "unaffected",
"product": "Guns",
"repo": "https://github.com/stylefeng/Guns",
"vendor": "stylefeng",
"versions": [
{
"lessThanOrEqual": "8.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T16:03:07.084Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #119",
"tags": [
"issue-tracking"
],
"url": "https://github.com/stylefeng/Guns/issues/119"
},
{
"tags": [
"product"
],
"url": "https://github.com/stylefeng/Guns"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119"
},
{
"tags": [
"technical-description"
],
"url": "https://repo1.maven.org/maven2/com/javaguns/roses/system-business-portal/8.3.5/system-business-portal-8.3.5-sources.jar"
},
{
"name": "VulnCheck Advisory: Guns through 8.3.5 Improper Access Control via SysNoticeController",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/guns-through-8.3.5-improper-access-control-via-sysnoticecontroller"
}
],
"title": "Guns through 8.3.5 Improper Access Control via SysNoticeController",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92601",
"datePublished": "2026-09-16T16:03:07.084Z",
"dateReserved": "2026-09-16T13:48:49.970Z",
"dateUpdated": "2026-09-16T17:27:01.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92600 (GCVE-0-2026-92600)
Vulnerability from nvd – Published: 2026-09-16 16:03 – Updated: 2026-09-16 16:03
VLAI
EPSS
VEX
Title
Guns through 8.3.5 Information Disclosure via Missing Permission Check
Summary
Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/stylefeng/Guns/issues/118 | issue-tracking |
| https://github.com/stylefeng/Guns | product |
| https://github.com/stylefeng/Guns/blob/2a12947733… | technical-description |
| https://repo1.maven.org/maven2/com/javaguns/roses… | technical-description |
| https://www.vulncheck.com/advisories/guns-through… | third-party-advisory |
Date Public
2026-06-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/stylefeng/Guns",
"defaultStatus": "unaffected",
"product": "Guns",
"repo": "https://github.com/stylefeng/Guns",
"vendor": "stylefeng",
"versions": [
{
"lessThanOrEqual": "8.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T16:03:06.385Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #118",
"tags": [
"issue-tracking"
],
"url": "https://github.com/stylefeng/Guns/issues/118"
},
{
"tags": [
"product"
],
"url": "https://github.com/stylefeng/Guns"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119"
},
{
"tags": [
"technical-description"
],
"url": "https://repo1.maven.org/maven2/com/javaguns/roses/system-business-hr/8.3.5/system-business-hr-8.3.5-sources.jar"
},
{
"name": "VulnCheck Advisory: Guns through 8.3.5 Information Disclosure via Missing Permission Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/guns-through-8.3.5-information-disclosure-via-missing-permission-check"
}
],
"title": "Guns through 8.3.5 Information Disclosure via Missing Permission Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92600",
"datePublished": "2026-09-16T16:03:06.385Z",
"dateReserved": "2026-09-16T13:48:49.970Z",
"dateUpdated": "2026-09-16T16:03:06.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92601 (GCVE-0-2026-92601)
Vulnerability from cvelistv5 – Published: 2026-09-16 16:03 – Updated: 2026-09-16 17:27
VLAI
EPSS
VEX
Title
Guns through 8.3.5 Improper Access Control via SysNoticeController
Summary
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:26 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/stylefeng/Guns/issues/119 | issue-tracking |
| https://github.com/stylefeng/Guns | product |
| https://github.com/stylefeng/Guns/blob/2a12947733… | technical-description |
| https://repo1.maven.org/maven2/com/javaguns/roses… | technical-description |
| https://www.vulncheck.com/advisories/guns-through… | third-party-advisory |
Date Public
2026-06-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92601",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:26:21.178070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:27:01.781Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/stylefeng/Guns/issues/119"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/stylefeng/Guns",
"defaultStatus": "unaffected",
"product": "Guns",
"repo": "https://github.com/stylefeng/Guns",
"vendor": "stylefeng",
"versions": [
{
"lessThanOrEqual": "8.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T16:03:07.084Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #119",
"tags": [
"issue-tracking"
],
"url": "https://github.com/stylefeng/Guns/issues/119"
},
{
"tags": [
"product"
],
"url": "https://github.com/stylefeng/Guns"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119"
},
{
"tags": [
"technical-description"
],
"url": "https://repo1.maven.org/maven2/com/javaguns/roses/system-business-portal/8.3.5/system-business-portal-8.3.5-sources.jar"
},
{
"name": "VulnCheck Advisory: Guns through 8.3.5 Improper Access Control via SysNoticeController",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/guns-through-8.3.5-improper-access-control-via-sysnoticecontroller"
}
],
"title": "Guns through 8.3.5 Improper Access Control via SysNoticeController",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92601",
"datePublished": "2026-09-16T16:03:07.084Z",
"dateReserved": "2026-09-16T13:48:49.970Z",
"dateUpdated": "2026-09-16T17:27:01.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92600 (GCVE-0-2026-92600)
Vulnerability from cvelistv5 – Published: 2026-09-16 16:03 – Updated: 2026-09-16 16:03
VLAI
EPSS
VEX
Title
Guns through 8.3.5 Information Disclosure via Missing Permission Check
Summary
Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/stylefeng/Guns/issues/118 | issue-tracking |
| https://github.com/stylefeng/Guns | product |
| https://github.com/stylefeng/Guns/blob/2a12947733… | technical-description |
| https://repo1.maven.org/maven2/com/javaguns/roses… | technical-description |
| https://www.vulncheck.com/advisories/guns-through… | third-party-advisory |
Date Public
2026-06-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/stylefeng/Guns",
"defaultStatus": "unaffected",
"product": "Guns",
"repo": "https://github.com/stylefeng/Guns",
"vendor": "stylefeng",
"versions": [
{
"lessThanOrEqual": "8.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T16:03:06.385Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #118",
"tags": [
"issue-tracking"
],
"url": "https://github.com/stylefeng/Guns/issues/118"
},
{
"tags": [
"product"
],
"url": "https://github.com/stylefeng/Guns"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119"
},
{
"tags": [
"technical-description"
],
"url": "https://repo1.maven.org/maven2/com/javaguns/roses/system-business-hr/8.3.5/system-business-hr-8.3.5-sources.jar"
},
{
"name": "VulnCheck Advisory: Guns through 8.3.5 Information Disclosure via Missing Permission Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/guns-through-8.3.5-information-disclosure-via-missing-permission-check"
}
],
"title": "Guns through 8.3.5 Information Disclosure via Missing Permission Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92600",
"datePublished": "2026-09-16T16:03:06.385Z",
"dateReserved": "2026-09-16T13:48:49.970Z",
"dateUpdated": "2026-09-16T16:03:06.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}