CVE-2026-92601

Guns, an open-source Java admin/management platform, is affected by an improper access control flaw (CWE-862) in its SysNoticeController, where the requiredPermission flag defaults to false and is never overridden by any action method. Any user who can authenticate to the application — even without any role assigned — can therefore invoke the notice endpoints to create, edit, delete, publish, and retract system-wide notices directed at arbitrary users and departments. An attacker gains integrity-level control over the internal notice/messaging system, which could be abused to push fake announcements to an entire organization (e.g., for internal phishing) or to silently remove or alter legitimate communications, though CVSS indicates no confidentiality impact. All deployments running Guns version 8.3.5 or earlier are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and exploitation has not been observed in the wild.

What to do: Upgrade Guns to a release newer than 8.3.5 as soon as a patched version is published, since no fix is confirmed in the current data. In the interim, restrict network access to the Guns admin console to trusted users/networks, review accounts able to authenticate without assigned roles, and audit the notice records/logs (sys_notice) for unauthorized creations, edits, deletions, publishes, or retractions. Administrators who build from source should consider enforcing an explicit permission check on the SysNoticeController endpoints.