CVE-2026-90595: wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization
A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which releases are identified as affected?
The reported affected releases are wxiaoqi Spring-Cloud-Platform 1.0, 2.2, and 3.0.
What level of access does an attacker need?
The issue can be exploited remotely without user interaction, but the CVSS vector indicates that the attacker needs low privileges. The impact is rated low for confidentiality, integrity, and availability.
Is exploitation likely in practice?
A public exploit has been released and may be used in attacks. The project was reportedly notified through an issue report but had not responded at the time of publication.