CVE-2026-92600: Guns through 8.3.5 Information Disclosure via Missing Permission Check
Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Guns through 8.3.5to a version that resolves this vulnerability.Fixed in 8.3.5 - Configuration
Update SysUserController so both /sysUser/detail and /sysUser/page endpoints include the requiredPermission configuration, ensuring the permission interceptor performs RBAC validation for authenticated users.
SysUserController requiredPermission configuration for /sysUser/detail and /sysUser/page = configured (do not omit requiredPermission)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with a valid login token can exploit it. No additional role or permission is required because the affected endpoints bypass RBAC validation.
What information can be exposed?
The affected endpoints can disclose user account names, real names, email addresses, phone numbers, last login IP addresses, and role assignments. The disclosure can cover all users in the system.
Which endpoints should be restricted or monitored?
The affected endpoints are /sysUser/detail and /sysUser/page. Review access logs for authenticated requests to these paths, particularly requests made by accounts that would not normally be allowed to view user-directory or role information.