CVE-2026-92600

25th percentile - higher than 25% of all known CVEs

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.

An attacker can access personal data and account information of all users in the system, constituting a serious confidentiality breach and potentially leading to further attacks such as phishing or privilege escalation. This may result in violations of personal data protection regulations.

Update Guns to a version later than 8.3.5. Until the update is applied, manually configure the required permissions for the /sysUser/detail and /sysUser/page endpoints and monitor for unusual queries to these endpoints.