CVE-2026-90594: wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are known to be affected?
The affected versions identified are wxiaoqi Spring-Cloud-Platform 3.0.1 and 3.1.0. The issue is in the Permission Service, specifically PermissionService.checkUserPermission in /rpc/service/PermissionService.java.
What does an attacker need to exploit this issue?
Exploitation can be performed remotely with low attack complexity and requires low-level privileges. No user interaction is required, and a public exploit is available.
What is the likely impact of successful exploitation?
The flaw causes missing authorization and can result in low impact to confidentiality, integrity, and availability. The scope is unchanged.
Is a vendor fix available?
The available information does not identify a fix. The project was notified through an issue report but had not responded at the time of publication.