CVE-2026-90595: Spring-Cloud-Platform Auth Bypass Flaw

CVE-2026-90595 Overview

CVE-2026-90595 is a missing authorization vulnerability [CWE-862] in wxiaoqi Spring-Cloud-Platform versions 1.0, 2.2, and 3.0. The flaw resides in the OnlineController.getOnlineInfo function within aceModules/ace-admin/auth/controller/OnlineController.java. An authenticated remote attacker can invoke the endpoint to retrieve online session information without holding the required authorization. A public proof-of-concept archive has been released, increasing exposure risk. The upstream project was notified through a GitHub issue but has not published a response or fix at the time of disclosure.

Critical Impact
Authenticated remote attackers can access online session data exposed by the getOnlineInfo endpoint due to missing authorization checks, enabling session information disclosure across affected Spring-Cloud-Platform versions.

Affected Products

wxiaoqi Spring-Cloud-Platform 1.0
wxiaoqi Spring-Cloud-Platform 2.2
wxiaoqi Spring-Cloud-Platform 3.0

Discovery Timeline

2026-09-13 - CVE-2026-90595 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90595

Vulnerability Analysis

The vulnerability sits in the OnlineController.getOnlineInfo handler of the ace-admin authentication module. The endpoint returns information about currently online users and session data. It does not enforce a proper authorization check before returning that data. Any authenticated user, regardless of role, can call the endpoint and read session information intended for privileged administrators. The published proof-of-concept, distributed as poc_vuln2_session_exposure.zip, demonstrates unauthenticated retrieval of session data through the exposed endpoint.

Root Cause

The root cause is a missing authorization control [CWE-862] on the getOnlineInfo method. The controller does not validate that the caller holds an administrative role or the required permission before returning session details. Access control is expected but never applied at the method entry point.

Attack Vector

Exploitation is remote and requires low privileges. An attacker with a valid low-privilege account issues an HTTP request to the online-info endpoint exposed by the ace-admin service. The controller processes the request and returns session data belonging to other users, including administrators. No user interaction is required, and complexity is low. See the GitHub PoC Archive and the GitHub Issue #65 Discussion for context.

No verified exploitation code is reproduced here. Refer to the VulDB CVE-2026-90595 entry for technical indicators.

Detection Methods for CVE-2026-90595

Indicators of Compromise

HTTP requests targeting the getOnlineInfo endpoint of the ace-admin authentication module originating from non-administrative accounts.
Unexpected response payloads containing session identifiers, usernames, or login timestamps returned to low-privilege sessions.
Repeated polling of the online-info endpoint from a single authenticated session, indicating session enumeration.

Detection Strategies

Enable verbose access logging on the ace-admin service and alert on any invocation of OnlineController.getOnlineInfo by non-admin principals.
Correlate application logs with identity provider role assignments to identify unauthorized calls to administrative endpoints.
Deploy a web application firewall rule that blocks or logs requests to the online-info path from sessions without the administrator claim.

Monitoring Recommendations

Baseline normal traffic to ace-admin administrative endpoints and alert on deviation in caller identity or request volume.
Forward Spring-Cloud-Platform authentication logs to a centralized SIEM for cross-user session access correlation.
Track outbound response sizes from the endpoint; large or repeated payloads to low-privilege users indicate data harvesting.

How to Mitigate CVE-2026-90595

Immediate Actions Required

Restrict network access to the ace-admin service to trusted administrative networks only.
Revoke or reduce the privileges of any accounts that do not require administrative access.
Audit historical logs for prior invocations of getOnlineInfo by non-admin users.

Patch Information

No vendor patch is available at the time of publication. The maintainer of the wxiaoqi Spring-Cloud-Platform repository has been notified through GitHub Issue #65 but has not responded. Monitor the repository for a security release addressing the missing authorization check in OnlineController.getOnlineInfo.

Workarounds

Add a Spring Security method-level annotation such as @PreAuthorize("hasRole('ADMIN')") to the getOnlineInfo handler and rebuild the affected module.
Introduce an authorization filter or interceptor in front of the ace-admin controller layer to reject non-administrative callers.
Block the online-info endpoint at an upstream reverse proxy or API gateway for all requests lacking the required administrative role claim.

bash

# Configuration example
# Example nginx location block to restrict the vulnerable endpoint
location ~* /ace-admin/.*/online/info {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://spring-cloud-backend;
}