PT-2026-90974 · Wxiaoqi+1 · Spring-Cloud-Platform

Emiya

·

CVE-2026-90595

·

Published

2026-09-13

·

Updated

2026-09-15

CVSS v2.0

6.5

Medium

VectorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions wxiaoqi Spring-Cloud-Platform version 1.0 wxiaoqi Spring-Cloud-Platform version 2.2 wxiaoqi Spring-Cloud-Platform version 3.0
Description A security flaw allows remote attackers to bypass authorization. The issue resides in the getOnlineInfo() function within the OnlineController.java file located at aceModules/ace-admin/auth/controller/OnlineController.java.
Recommendations As a temporary workaround, consider restricting access to the getOnlineInfo() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863CWE-862

Related Identifiers

CVE-2026-90595

Affected Products

Spring-Cloud-Platform