---
id: "CVE-2026-116274"
kind: "vulnerability"
aliases: ["CVE-2026-116274"]
title: "JIZHICMS: order payment handler lets remote users act on others' orders"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "jizhicms", "package", "php", "self-hosted"]
not_affected_if: ["no-order-module"]
published_at: "2026-10-26T14:16:35+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116274", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# JIZHICMS: order payment handler lets remote users act on others' orders

JIZHICMS up to 2.5.6 has an improper authorization flaw in the Pay function of app/home/c/OrderController.php, where the orderno argument is not checked against the requesting user. A remote attacker can manipulate that argument to reach orders that are not theirs, and the exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed JIZHICMS version and whether it is `2.5.6` or earlier
- Review `app/home/c/OrderController.php` for the `Pay` function and whether it verifies that the order belongs to the logged-in user before using `orderno`

## Fix

- No fixed version is named in the sources; unknown
- Until a patch exists, restrict access to the order payment route or add an ownership check on `orderno` in the `Pay` function

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116274

## From the sources

A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_