Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92600Guns through 8.3.5 Information Disclosure via Missing Permission Check

Medium 6.5

In plain English

A medium-severity missing authorization in Guns from stylefeng. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 63.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.

Affected products (as reported)

Vendor	Product	Versions
stylefeng	Guns	0 – through 8.3.5

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #118 issue-tracking
https://github.com/stylefeng/Guns product
https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119 technical-description
https://repo1.maven.org/maven2/com/javaguns/roses/system-business-hr/8.3.5/system-business-hr-8.3.5-sources.jar technical-description
VulnCheck Advisory: Guns through 8.3.5 Information Disclosure via Missing Permission Check third-party-advisory