CVE-2026-92601: Guns through 8.3.5 Improper Access Control via SysNoticeController
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.
Affected Software
Event History
Frequently Asked Questions
Which accounts are exposed to this issue?
Any authenticated Guns user without assigned roles may be able to exploit it. The affected controller actions can create, edit, delete, publish, and retract notices for arbitrary users and departments.
Does exploitation require administrator privileges or user interaction?
No administrator role is required; a low-privileged authenticated account without assigned roles is sufficient. No user interaction is required.
What is the underlying access-control condition?
SysNoticeController has requiredPermission set to false by default, and its action methods do not override that setting. As a result, permission checks are not required for the affected notice-management actions.