CVE-2026-90594

MediumCVSS 6.3

Published: 13/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 14/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0 affecting the function PermissionService.checkUserPermission in /rpc/service/PermissionService.java of the Permission Service component. The manipulation leads to missing authorization. Remote exploitation is possible and a public exploit is available.

Risk Assessment

Missing authorization allows unauthorized users to access privileged functions, potentially leading to privilege escalation and unauthorized operations. The project has not responded to the report, so a fix may not be available.

Recommendation

Immediately verify and restrict access to the Permission Service component, apply workarounds if possible, or upgrade to a patched version. Monitor logs for unauthorized access attempts.

Other vulnerabilities in Spring-Cloud-Platform

CVE-2026-90595Medium
A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Original NVD description (English source)

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS