---
id: CVE-2026-92601
title: >-
  Guns through 8.3.5 contains an improper access control vulnerability in
  SysNoticeController where requiredPermission defaults to false and is not
  overridden by any action methods
summary: >-
  Guns through 8.3.5 contains an improper access control vulnerability in
  SysNoticeController where requiredPermission defaults to false and is not
  overridden by any action methods. Authenticated users without assigned roles
  can exploit th…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-862
vendor: stylefeng
product: Guns
affected:
  - Guns <= 8.3.5
published: '2026-09-16'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:49.073'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92601'
references:
  - url: 'https://github.com/stylefeng/Guns'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/stylefeng/Guns/blob/2a12947733945d5c06197d99ecaa77d7f2b0aeba/src/main/java/cn/stylefeng/guns/core/security/TokenAndPermissionInterceptor.java#L110-L119
    label: disclosure@vulncheck.com
  - url: 'https://github.com/stylefeng/Guns/issues/119'
    label: disclosure@vulncheck.com
  - url: >-
      https://repo1.maven.org/maven2/com/javaguns/roses/system-business-portal/8.3.5/system-business-portal-8.3.5-sources.jar
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/guns-through-8.3.5-improper-access-control-via-sysnoticecontroller
    label: disclosure@vulncheck.com
  - url: 'https://github.com/stylefeng/Guns/issues/119'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00389
epssPercentile: 0.30133
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T17:26:21.178070Z'
ingestedAt: '2026-09-16T16:59:56.621Z'
---

## Overview

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.