Description

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T21:17:02.980Z",
  "pubdate": "2026-09-13T21:17:02.980Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in the wxiaoqi Spring-Cloud-Platform, specifically within versions 3.0.1 and 3.1.0.\nThe vulnerability resides in the PermissionService.checkUserPermission function, which fails to correctly enforce security constraints.\nThis flaw results in missing authorization, allowing remote, unauthenticated, or unauthorized actors to perform actions that should be restricted.\nThe risk is elevated by the availability of public exploit code, increasing the likelihood of active exploitation.\nThe impacted system component is the Permission Service, which is responsible for critical access control decisions.\nFailure to remediate this vulnerability may lead to unauthorized data access, privilege escalation, or modification of system state.\nThe maintainers have not yet addressed the reported issue, leaving affected deployments currently exposed.",
  "technicalDetails": "The vulnerability is located in the PermissionService.checkUserPermission function within the /rpc/service/PermissionService.java file of the Spring-Cloud-Platform component.\nThe root cause is a failure in the logic responsible for validating user permissions before granting access to protected resources. The implementation of checkUserPermission lacks adequate verification mechanisms, allowing bypasses when processing authorization requests.\nExploitation is possible remotely by crafting and submitting malicious requests that interact with the vulnerable Permission Service. Because the function fails to correctly validate the requester's identity or authorization context, the system implicitly treats the request as authorized.\nThe attack flow involves an adversary targeting the exposed RPC (Remote Procedure Call) endpoints that utilize the PermissionService. By sending a request that omits or bypasses the necessary authentication tokens or authorization headers, an attacker forces the application to evaluate access without proper validation.\nSince the checkUserPermission function is the primary gatekeeper for user access within this service, a failure here effectively invalidates the entire access control matrix implemented by the platform.\nThe vulnerability does not appear to require elevated privileges or pre-existing authentication, as the code itself handles the authorization check incorrectly. This makes the system susceptible to unauthenticated remote exploitation.\nThe impact post-exploitation includes unauthorized access to administrative functions, data exfiltration, and the potential to execute operations restricted to high-privilege users. Given the public availability of exploit code, attackers can easily identify and exploit the vulnerable function in production environments where the service is reachable over the network.\nThe lack of vendor-provided patches means that the underlying logic remains flawed, and manual intervention is necessary to prevent exploitation."
}