CVE-2026-120319 in PublicCMS
Summary
by MITRE • 11/02/2026
A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Sanluan PublicCMS versions 4.x through 6.x represents a critical security flaw within the e-commerce transaction module, specifically affecting the TradeRefundService component located at publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java. This issue centers on the updateAmound method, which is responsible for processing refund requests in the system's financial workflow. The core technical flaw lies in an insufficient validation of input parameters during the execution of this function. Specifically, the application fails to properly enforce access control policies when handling the refundId argument provided by the user or client request. This oversight allows an attacker to manipulate the identifier associated with a specific transaction, thereby bypassing the intended authorization mechanisms that should restrict such operations to authorized administrative users only.
From a technical perspective, this vulnerability is classified as Broken Access Control, which corresponds to CWE-269 in the Common Weakness Enumeration standard. The absence of proper server-side checks on the refundId parameter means that the application trusts client-supplied data without verifying whether the requester has legitimate privileges to modify or view that specific record. This type of flaw often stems from insecure direct object references, where internal implementation objects are exposed to users without adequate indirection or permission checking layers. Consequently, an attacker can craft malicious requests with arbitrary refund identifiers, potentially leading to unauthorized modifications of financial records, fraudulent refunds, or data integrity issues within the platform's database.
The operational impact of this vulnerability is severe due to its remote exploitability and the availability of public proof-of-concept code. Because the attack vector is network-based, a threat actor can initiate exploitation from any location with internet connectivity without requiring prior authentication or local access. The existence of publicly available exploits significantly lowers the barrier for entry, enabling less sophisticated attackers to compromise vulnerable instances. Successful exploitation could result in financial loss through fraudulent refund processing, corruption of transactional data, and potential downstream impacts on business operations that rely on accurate e-commerce records. Furthermore, the lack of response from the vendor since early contact suggests a prolonged window of exposure where systems remain unpatched, increasing the risk profile for all organizations still running affected versions.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The most effective solution is to upgrade Sanluan PublicCMS to a version that includes patches for this authorization bypass issue, although the vendor's lack of communication may necessitate seeking alternative updates or community-driven fixes if available. In the interim, administrators should implement strict input validation on all service layer methods handling sensitive identifiers like refundId, ensuring that only valid and authorized references are processed. Additionally, deploying a Web Application Firewall with rules tailored to detect manipulation attempts in transactional endpoints can provide an additional layer of defense. Regular security audits focusing on access control logic within financial modules are also recommended to identify similar weaknesses before they can be exploited by malicious actors seeking unauthorized financial gains or data tampering capabilities aligned with ATT&CK techniques related to privilege escalation and lateral movement via compromised application credentials.