CVE-2026-90594

Received Received - Intake

Missing Authorization in Spring-Cloud-Platform

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90594

Affected Vendors & Products

Vendor	Product	Version / Range
wxiaoqi	spring-cloud-platform	From 3.0.1 (inc) to 3.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is in wxiaoqi Spring-Cloud-Platform versions 3.0.1 and 3.1.0. It affects the PermissionService.checkUserPermission function in the file /rpc/service/PermissionService.java. The issue allows unauthorized access due to missing authorization checks. An attacker can remotely exploit this vulnerability, and a public exploit is available.

Impact Analysis

An attacker could gain unauthorized access to sensitive functions or data by exploiting this missing authorization. This could lead to data breaches, unauthorized modifications, or other malicious activities depending on the platform's configuration and permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately restrict access to the PermissionService.checkUserPermission function in /rpc/service/PermissionService.java. Disable remote exploitation paths and review user permissions to ensure least privilege access. Monitor network traffic for unusual activity targeting this component.

Hi! I’m here to help you understand CVE-2026-90594. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70