CVE-2026-92601: Guns Framework Auth Bypass Vulnerability

CVE-2026-92601 Overview

CVE-2026-92601 is an improper access control vulnerability in Guns through version 8.3.5, an open-source Java-based rapid development platform. The flaw resides in the SysNoticeController component, where the requiredPermission attribute defaults to false and is not overridden by any action method. Authenticated users without assigned roles can create, edit, delete, publish, and retract system-wide notices that affect arbitrary users and departments. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact
Any authenticated user, including accounts without assigned roles, can manipulate system-wide notices and impersonate administrative communications to arbitrary users and departments.

Affected Products

Guns platform versions up to and including 8.3.5
system-business-portal module distributed via Maven under com.javaguns.roses
Deployments relying on TokenAndPermissionInterceptor for permission enforcement in SysNoticeController

Discovery Timeline

2026-09-16 - CVE-2026-92601 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92601

Vulnerability Analysis

Guns enforces authorization through a Spring interceptor named TokenAndPermissionInterceptor. Controller action methods are expected to declare a requiredPermission flag that signals whether the interceptor should validate the caller's role permissions. In SysNoticeController, this flag remains at its default value of false for every action.

As a result, the interceptor allows requests to SysNoticeController endpoints after only verifying that the token is valid. No role or permission comparison occurs. Endpoints for notice creation, editing, deletion, publication, and retraction become available to every authenticated user, including accounts with no roles.

The vulnerability affects data integrity rather than confidentiality or availability. Attackers can inject arbitrary content into notices that are broadcast platform-wide, enabling phishing, misinformation, and internal social engineering against users and departments that trust the notice channel.

Root Cause

The root cause is missing authorization enforcement on privileged controller methods. The requiredPermission field on SysNoticeController is not overridden, so the permission interceptor treats the endpoints as public to any authenticated session. See the interceptor logic referenced in the GitHub Token Permission Interceptor.

Attack Vector

An attacker first obtains any authenticated session, for example a low-privilege or newly created account. The attacker then issues HTTP requests to SysNoticeController endpoints responsible for notice lifecycle operations. Because the interceptor does not compare the caller's assigned roles against a required permission, all notice actions succeed. Full technical details are available in the VulnCheck Advisory on Guns and GitHub Issue #119.

Detection Methods for CVE-2026-92601

Indicators of Compromise

Notice creation, edit, delete, publish, or retract events originating from user accounts that have no assigned roles or department administration rights.
Notice audit records that reference target users or departments outside the acting account's normal scope.
HTTP access logs showing successful requests to SysNoticeController endpoints from low-privilege session tokens.

Detection Strategies

Correlate notice lifecycle events with the acting principal's role assignments and flag any mismatch as suspicious.
Deploy runtime application self-protection or web application firewall rules that inspect requests to /sysNotice/* paths and require a role claim in the session.
Review Spring MVC handler mappings for controllers where requiredPermission is false on state-changing methods.

Monitoring Recommendations

Enable verbose audit logging for all SysNoticeController actions, including principal, roles, target scope, and payload.
Alert when the ratio of notice actions to authenticated sessions increases outside baseline for the notice subsystem.
Forward application logs to a centralized analytics platform to preserve evidence of notice tampering across restarts.

How to Mitigate CVE-2026-92601

Immediate Actions Required

Restrict access to SysNoticeController endpoints at the reverse proxy or API gateway to administrative user groups until a patched build is deployed.
Rotate or invalidate active sessions for low-privilege accounts to remove opportunistic access to notice endpoints.
Audit existing notices for unauthorized entries and remove any content that was not issued by an authorized administrator.

Patch Information

No fixed version is published in the NVD entry at the time of writing. Track the upstream project at the GitHub Guns Repository and the discussion in GitHub Issue #119 for a corrected release. Verify installed artifacts against the Maven Source Code for System Business Portal to confirm the vulnerable version.

Workarounds

Override requiredPermission to true on every action method within SysNoticeController and rebuild the affected module.
Add an explicit @PreAuthorize or equivalent role check on notice creation, edit, delete, publish, and retract handlers.
Configure TokenAndPermissionInterceptor to fail closed by defaulting requiredPermission to true for all controllers unless explicitly relaxed.

bash

# Configuration example: restrict notice endpoints at a reverse proxy
location ~ ^/sysNotice/ {
    # Only allow requests bearing the admin role header injected by the auth layer
    if ($http_x_user_role !~ "admin") {
        return 403;
    }
    proxy_pass http://guns_backend;
}