CVE-2026-110113 in PublicCMS
Summary
by MITRE • 10/13/2026
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in PublicCMS versions through V6.202608.a represents a critical failure in access control mechanisms within the TradeAddressController module. Specifically, the tradeAddress/save handler operates under an insecure direct object reference paradigm where the application relies solely on sequential numeric identifiers to manage shipping address records without implementing any form of authorization verification. This architectural flaw allows authenticated users to interact with resources belonging to other system participants by simply manipulating the input parameters associated with these unique identifiers. The core technical deficiency lies in the absence of a check that validates whether the session user possesses ownership or administrative rights over the specific resource being modified, thereby treating all object references as publicly accessible within the context of an authenticated session.
From a technical perspective, this flaw enables attackers to perform unauthorized modifications to sensitive personal data stored by other members. By submitting a different member's sequential numeric address ID in place of their own, an attacker can overwrite critical fields such as the addressee name, telephone number, and physical shipping address associated with that victim record. This capability effectively allows for the hijacking or alteration of user profiles without requiring additional authentication steps beyond what is already required to log into the application. The reliance on predictable sequential IDs exacerbates this risk, as attackers can easily iterate through a range of identifiers to discover valid targets within the database structure.
The operational impact of this vulnerability extends beyond simple data modification. It compromises the integrity and confidentiality of user information, which may lead to privacy violations or facilitate further attacks such as account takeover via address-based verification processes if those are present in other parts of the system. Furthermore, it undermines trust in the platform's security posture by demonstrating that basic access control principles were not enforced at the controller level. This type of vulnerability is commonly associated with CWE-284 Improper Access Control and falls under the MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials to perform unauthorized actions against other user resources.
To mitigate this issue, developers must implement strict object-level authorization checks within the tradeAddress/save handler before any database updates are executed. This involves verifying that the ID of the address being modified matches an identifier linked to the currently authenticated session user or possesses appropriate administrative privileges for cross-user modifications. Additionally, adopting non-sequential identifiers such as UUIDs can reduce the ease with which attackers enumerate valid targets, although this should not be relied upon as a primary security control since it does not replace proper access validation. Regular code reviews focusing on input validation and authorization logic are essential to prevent similar flaws in other modules of the application.