CVE-2026-92601 — Guns through 8.3.5 Improper Access Control via SysNoticeController
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action method…
Published: 2026-09-16 · CVSS: 7.1 · CVSS 4.0
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7