CVE-2026-90594: Spring-Cloud-Platform Auth Bypass Vulnerability

CVE-2026-90594 Overview

CVE-2026-90594 is a missing authorization vulnerability in wxiaoqi Spring-Cloud-Platform versions 3.0.1 and 3.1.0. The flaw resides in the PermissionService.checkUserPermission function within /rpc/service/PermissionService.java. Attackers with low privileges can bypass permission checks remotely over the network, gaining access to resources they should not be able to reach. A proof-of-concept exploit is publicly available. The project maintainers were notified through a GitHub issue but have not yet responded. The weakness is categorized under CWE-862: Missing Authorization.

Critical Impact
Authenticated remote attackers can abuse the permission check logic to bypass authorization controls in Spring-Cloud-Platform, exposing confidentiality, integrity, and availability of protected functionality.

Affected Products

wxiaoqi Spring-Cloud-Platform 3.0.1
wxiaoqi Spring-Cloud-Platform 3.1.0
Component: Permission Service (/rpc/service/PermissionService.java)

Discovery Timeline

2026-09-13 - CVE-2026-90594 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90594

Vulnerability Analysis

The vulnerability affects the checkUserPermission function inside PermissionService.java in the RPC service layer of Spring-Cloud-Platform. The function is responsible for validating whether an authenticated user is allowed to perform a requested action. Because the check is implemented in a fail-open manner, manipulated inputs cause the function to return an authorized result even when the caller lacks the necessary permission. The public proof-of-concept archive published by the reporter demonstrates the authorization bypass against both affected releases.

Root Cause

The root cause is a missing or improperly enforced authorization check in PermissionService.checkUserPermission [CWE-862]. The service relies on permission logic that does not fail closed when required attributes are absent or malformed. As a result, an attacker can influence the decision path and receive a positive authorization outcome without holding the corresponding role or permission grant.

Attack Vector

Exploitation requires network access to the RPC permission service and a low-privileged authenticated session. No user interaction is needed. The attacker crafts an RPC request to PermissionService.checkUserPermission that manipulates the permission evaluation path, causing the service to grant access to protected resources. Because the flaw is server-side and reachable over the network, the vulnerable endpoint should be considered exposed wherever the RPC layer is accessible.

A public proof-of-concept archive named poc_vuln1_failopen_authz.zip is hosted on GitHub. Refer to the VulDB entry for CVE-2026-90594 and the GitHub Issue #64 Discussion for technical details.

Detection Methods for CVE-2026-90594

Indicators of Compromise

Unexpected successful RPC calls to PermissionService.checkUserPermission originating from low-privileged accounts.
Access to administrative or restricted endpoints by users whose roles do not include the corresponding permissions.
Presence of request patterns matching the public proof-of-concept archive.

Detection Strategies

Enable verbose audit logging on the Permission Service and correlate permission grants against the requesting principal's role assignments.
Deploy application-layer monitoring rules that flag authorization decisions returning true without a matching entry in the role-permission mapping.
Review Spring Cloud gateway logs for repeated calls to the RPC permission endpoint from a single low-privileged session.

Monitoring Recommendations

Alert on privilege inconsistencies where a user's effective actions exceed their assigned role scope.
Baseline normal RPC traffic to /rpc/service/PermissionService and flag deviations in volume or caller identity.
Forward Spring-Cloud-Platform application logs into a central SIEM or data lake for retrospective analysis and correlation.

How to Mitigate CVE-2026-90594

Immediate Actions Required

Restrict network access to the RPC Permission Service so it is reachable only from trusted internal services.
Audit existing accounts and revoke any privileges that appear to have been granted through the vulnerable code path.
Monitor the upstream GitHub repository and Issue #64 for a maintainer response.

Patch Information

No official patch is available at the time of publication. The project maintainers were informed through a GitHub issue report but have not yet responded. Organizations running Spring-Cloud-Platform 3.0.1 or 3.1.0 should treat the affected component as unpatched and apply compensating controls until a fix is released.

Workarounds

Place an authenticating reverse proxy or API gateway in front of the RPC service and enforce role-based access control externally.
Apply a local source patch to PermissionService.checkUserPermission that fails closed when permission evaluation inputs are missing or ambiguous.
Segment the Spring-Cloud-Platform deployment so the RPC layer is not reachable from untrusted networks or user-facing tiers.
Increase logging granularity on the Permission Service to support rapid identification of bypass attempts.

bash

# Example: restrict RPC service exposure with an iptables rule
# Allow only the internal service subnet to reach the RPC port
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP