CVE-2026-92600: Guns Framework Information Disclosure Flaw

CVE-2026-92600 Overview

CVE-2026-92600 is an information disclosure vulnerability in the Guns framework through version 8.3.5. The flaw resides in SysUserController, where the /sysUser/detail and /sysUser/page endpoints omit the requiredPermission configuration. As a result, the permission interceptor skips role-based access control (RBAC) validation for authenticated users. Any user with a valid login token can enumerate sensitive data for all system accounts, including usernames, real names, email addresses, phone numbers, last login IP addresses, and role assignments. The weakness is classified as Missing Authorization [CWE-862].

Critical Impact
Authenticated attackers can harvest personally identifiable information (PII) and role metadata for every user in a Guns deployment, enabling targeted phishing and privilege-focused follow-on attacks.

Affected Products

Guns framework versions through 8.3.5
system-business-hr module 8.3.5 distributed via Maven Central
Applications built on the vulnerable SysUserController component

Discovery Timeline

2026-09-16 - CVE-2026-92600 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92600

Vulnerability Analysis

Guns enforces authorization through a Spring interceptor (TokenAndPermissionInterceptor) that reads a requiredPermission annotation or configuration entry to decide whether to run RBAC checks. Controller methods that do not declare requiredPermission are treated as authenticated-only endpoints. The interceptor validates the caller's token, then returns without evaluating role membership.

The /sysUser/detail and /sysUser/page handlers in SysUserController return administrator-level user records but were shipped without the requiredPermission declaration. Any low-privilege account, including a self-registered or default operator, can issue requests to these endpoints and receive the full user directory.

Root Cause

The root cause is a missing authorization declaration on privileged controller routes. The interceptor's default behavior when no permission string is defined is to permit access rather than deny it. This fail-open pattern combined with the omission in SysUserController produces a broken access control condition. See the Token Permission Interceptor source for the check logic.

Attack Vector

Exploitation requires network access to the application and any valid session token. An attacker authenticates with low-privilege credentials, then sends HTTP requests to /sysUser/page to enumerate all users or /sysUser/detail to retrieve a specific record. The response body contains account names, real names, email addresses, phone numbers, last login IP addresses, and assigned roles. No user interaction and no additional privilege escalation are required.

Refer to the VulnCheck advisory and GitHub Issue #118 for the disclosed technical details.

Detection Methods for CVE-2026-92600

Indicators of Compromise

HTTP GET or POST requests to /sysUser/page or /sysUser/detail originating from non-administrator session tokens.
Bulk pagination requests to /sysUser/page with incrementing pageNo or pageSize parameters from a single session.
Application logs showing successful 200 OK responses on user directory endpoints for accounts lacking administrator roles.

Detection Strategies

Correlate authenticated session identifiers with the roles assigned to that user, then flag any access to /sysUser/* endpoints by non-privileged sessions.
Deploy web application firewall (WAF) rules that inspect the requesting user's role claim before allowing traffic to Guns administrative APIs.
Review historical access logs for requests to /sysUser/detail and /sysUser/page and validate that the caller had a legitimate administrative role at request time.

Monitoring Recommendations

Enable verbose request logging in TokenAndPermissionInterceptor to capture the resolved principal and permission decision for every request.
Alert on outbound egress volume spikes from application servers hosting Guns, which may indicate bulk user data exfiltration.
Track failed and successful authentication events alongside subsequent access to sensitive endpoints to identify credential stuffing pivots into user enumeration.

How to Mitigate CVE-2026-92600

Immediate Actions Required

Restrict network access to Guns administrative interfaces to trusted management networks until a patched build is deployed.
Add explicit requiredPermission annotations to /sysUser/detail and /sysUser/page handlers in SysUserController and rebuild the application.
Rotate credentials, session tokens, and API keys for any account whose data may have been exposed to unauthorized session holders.
Audit all controllers in the project for missing requiredPermission declarations and remediate any additional privileged endpoints.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Consumers should monitor the Guns GitHub repository and Issue #118 for a fixed release, and review the Maven source JAR for version 8.3.5 to confirm the vulnerable code path in their build. Until an upstream fix ships, apply a local patch that adds the missing RBAC annotations.

Workarounds

Change the interceptor default to deny access when requiredPermission is absent, converting the fail-open behavior into fail-closed.
Place a reverse proxy in front of Guns that enforces role-based access control on /sysUser/* routes independently of the application.
Disable or remove the vulnerable endpoints if the deployment does not require the user directory API.

bash

# Configuration example
# Vendor-neutral controller hardening: add the missing permission check
# in SysUserController before redeploying the application.
#
# @Permission("sys:user:detail")
# @GetMapping("/sysUser/detail")
#
# @Permission("sys:user:page")
# @GetMapping("/sysUser/page")
#
# Restrict management endpoints at the reverse proxy layer:
# location ~ ^/sysUser/(detail|page) {
#     allow 10.0.0.0/8;
#     deny all;
#     proxy_pass http://guns_backend;
# }