CVE-2026-90595

Received Received - Intake

Missing Authorization in Spring-Cloud-Platform

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90595

Affected Vendors & Products

Vendor	Product	Version / Range
wxiaoqi	spring-cloud-platform	From 1.0 (inc) to 3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization flaw in the wxiaoqi Spring-Cloud-Platform versions 1.0, 2.2, and 3.0. It exists in the OnlineController.getOnlineInfo function of the file aceModules/ace-admin/auth/controller/OnlineController.java. The issue allows remote attackers to manipulate the system without proper authorization.

Impact Analysis

The vulnerability enables remote attackers to execute unauthorized actions on the affected system. Since the exploit is publicly available, attackers could leverage it to gain unauthorized access, manipulate data, or disrupt services. The lack of a response from the project maintainers increases the risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements under GDPR and HIPAA. GDPR mandates strict access controls and breach notifications, while HIPAA requires safeguards to protect sensitive health data. Exploitation may result in non-compliance penalties.

Mitigation Strategies

Immediately restrict access to the OnlineController.getOnlineInfo endpoint. Review and update authentication mechanisms for the wxiaoqi Spring-Cloud-Platform. Monitor network traffic for unauthorized access attempts to the affected function.

Hi! I’m here to help you understand CVE-2026-90595. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70