Guns CVE-2026-92600

Requires the attacker to hold ANY valid Guns login token (PR:L authenticated session) - the flaw does not permit unauthenticated access. The specific limiting/enabling condition is code-level: the SysUserController /sysUser/detail and /sysUser/page handlers omit the requiredPermission annotation, so the TokenAndPermissionInterceptor performs no RBAC check on them; this affects default builds of Guns through 8.3.5 with no special configuration needed beyond a running instance and a valid account. Exploitation is limited only by needing that authenticated session and network reachability to the admin application; no user interaction, no admin privileges, and no non-default setting are required.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) scoring 7.1 is internally consistent with the description: a network-reachable flaw requiring only a low-privileged authenticated session (any valid login token) to read all users' PII with no user interaction. This is a genuine broken-access-control (CWE-862) issue, not a false-positive high-CVSS: the exploit is trivial (two GET-style endpoints missing a requiredPermission annotation) and the impact - full user directory including emails, phone numbers, last-login IPs, and role assignments - is a realistic mass-PII disclosure and recon aid for privilege escalation. However, real-world priority is tempered by missing/limiting signals: no EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation is not confirmed active or automated at scale. Crucially, PR:L means the attacker must ALREADY hold a valid account, which bounds the population of exploiters to authenticated (possibly self-registered or low-tier) users. The confidentiality impact is real but scope is unchanged (SC/SI/SA:N) and there is no integrity or availability effect. Net: a credible, easily-exploited insider/low-privilege data-exposure bug, but not an unauthenticated internet-wide emergency.

An attacker obtains any valid Guns login token - for example a low-privilege employee account or a self-registered user - and issues requests to /sysUser/page and /sysUser/detail, which lack the requiredPermission configuration so the TokenAndPermissionInterceptor skips RBAC checks. The response returns the full user roster (account names, real names, emails, phone numbers, last-login IPs, role assignments), which the attacker harvests for phishing, credential-stuffing, or targeting admin accounts. No public exploit is identified at time of analysis, but the attack requires no special tooling given the low CVSS complexity (AC:L).