CVE-2026-92600

The Guns administration platform through version 8.3.5 contains a missing-authorization flaw (CWE-862) in SysUserController: the /sysUser/detail and /sysUser/page endpoints lack the requiredPermission configuration, so the platform's permission interceptor skips RBAC validation entirely for these routes. Any remote attacker holding any valid login token — regardless of assigned role — can call these endpoints and retrieve account names, real names, email addresses, phone numbers, last login IPs, and role assignments for every user in the system. This effectively discloses the full user directory of the console, which is valuable for phishing, social engineering, and reconnaissance toward privilege escalation. All deployments of Guns up to and including 8.3.5 are affected, with risk concentrated in systems exposed beyond the local network. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known.

What to do: Upgrade Guns to the latest release beyond 8.3.5 as soon as a patched version is available, since the fixed version is not specified in current disclosures. As an interim mitigation, restrict or block access to /sysUser/detail and /sysUser/page at the gateway/WAF for non-administrator roles, or add the missing requiredPermission annotations on those endpoints. Review access logs for calls to these endpoints by low-privilege accounts to detect prior abuse.