stylefeng Guns CVE-2026-92601

Requires a valid authenticated Guns session on any version through 8.3.5 - but the account may have NO assigned roles, since the SysNoticeController create/edit/delete/publish/retract actions never set requiredPermission (the interceptor default of false is left in place). The only limiting factor is obtaining any authenticated account (PR:L); no user interaction, no admin role, and no special non-default configuration is needed. Impact is limited to integrity of the system-notice subsystem across arbitrary users and departments.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) is internally consistent with the description: a remote, low-privileged, authenticated user can trivially exploit a missing authorization check, with impact confined to integrity (VI:H) - no confidentiality or availability loss. That aligns with CWE-862 (Missing Authorization) and the root cause that requiredPermission in TokenAndPermissionInterceptor defaults to false and is never overridden by SysNoticeController action methods. The 7.1 rating is credible but modest because the impact is data-integrity of a notice subsystem, not full compromise. There is no CISA KEV listing, no EPSS score provided, and no public POC referenced, so this is 'no public exploit identified at time of analysis' - a real but not urgent priority. One nuance to verify: the tag labels this 'Authentication Bypass', but the flaw is an authorization/access-control failure that still requires a valid authenticated session (PR:L), not an authentication bypass - do not treat it as pre-auth. The VulnCheck advisory and the exact source line references (interceptor L110-L119, plus the 8.3.5 sources jar) make the technical root cause well-corroborated.

An attacker registers or obtains any low-privilege Guns account, even one with no roles assigned, and sends authenticated HTTP requests directly to the SysNoticeController create/edit/delete/publish/retract endpoints. Because the permission interceptor never enforces a required permission for these actions, the requests succeed, letting the attacker post, alter, or remove system-wide notices targeting arbitrary users and departments. No public exploit code is identified, but exploitation requires only a standard authenticated session and simple crafted requests.