{"id":"CVE-2026-90594","state":"PUBLISHED","title":"wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization","description":"A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.","publishedAt":"2026-09-13T20:45:09.702Z","updatedAt":"2026-09-14T16:24:40.937Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["wxiaoqi Spring-Cloud-Platform"],"affected":[{"vendor":"wxiaoqi","product":"Spring-Cloud-Platform","versions":[{"version":"3.0.1","status":"affected"},{"version":"3.1.0","status":"affected"}],"cpes":["cpe:2.3:a:wxiaoqi:spring-cloud-platform:*:*:*:*:*:*:*:*"],"modules":["Permission Service"]}],"references":["https://vuldb.com/vuln/403176","https://vuldb.com/vuln/403176/cti","https://vuldb.com/cve/CVE-2026-90594","https://vuldb.com/submit/913788","https://github.com/wxiaoqi/Spring-Cloud-Platform/issues/64","https://github.com/user-attachments/files/30627348/poc_vuln1_failopen_authz.zip","https://github.com/wxiaoqi/Spring-Cloud-Platform/"],"weaknesses":["CWE-862","CWE-863"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90594.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90594","state":"PUBLISHED","datePublished":"2026-09-13T20:45:09.702Z","dateUpdated":"2026-09-14T16:24:40.937Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-12T18:26:39.486Z"},"containers":{"cna":{"title":"wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization","descriptions":[{"lang":"en","value":"A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"vendor":"wxiaoqi","product":"Spring-Cloud-Platform","versions":[{"version":"3.0.1","status":"affected"},{"version":"3.1.0","status":"affected"}],"cpes":["cpe:2.3:a:wxiaoqi:spring-cloud-platform:*:*:*:*:*:*:*:*"],"modules":["Permission Service"]}],"references":[{"url":"https://vuldb.com/vuln/403176","name":"VDB-403176 | wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/403176/cti","name":"VDB-403176 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-90594","name":"CVE-2026-90594 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/913788","name":"Submit #913788 | wxiaoqi  Spring-Cloud-Platform 3.0 Missing Authorization","tags":["third-party-advisory"]},{"url":"https://github.com/wxiaoqi/Spring-Cloud-Platform/issues/64","tags":["issue-tracking"]},{"url":"https://github.com/user-attachments/files/30627348/poc_vuln1_failopen_authz.zip","tags":["exploit"]},{"url":"https://github.com/wxiaoqi/Spring-Cloud-Platform/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","type":"CWE","lang":"en","description":"Missing Authorization"}]},{"descriptions":[{"cweId":"CWE-863","type":"CWE","lang":"en","description":"Incorrect Authorization"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-09-13T20:45:09.702Z"},"timeline":[{"time":"2026-09-12T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-12T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-12T20:35:15.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"emiya (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202609"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-14T16:24:28.022518Z","id":"CVE-2026-90594","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-14T16:24:40.937Z"}}]}}}