CVE-2026-92601

25th percentile - higher than 25% of all known CVEs

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.

Users without appropriate permissions can modify system-wide notices, potentially leading to disinformation, injection of malicious content, or disruption of communication across the organization. This constitutes a breach of data integrity.

Update Guns to a version later than 8.3.5. Until the update is applied, manually configure the required permissions for SysNoticeController actions and monitor changes to notices.