Live › vulnerability › CVE-2026-120319
PublicCMS, a Java content management system, has an authorization bypass in its trade refund service, where manipulating the refundId argument skips access checks. A remote attacker could change refund records they should not be able to touch, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 02:23 UTC. All times on this page are UTC.
Sites running PublicCMS 4.x, 5.x or 6.x with the trade module, which handles refunds. The sources say the vendor did not respond to disclosure, so no patched version is known. Installations without the trade module or refund feature are likely not reached, but the sources do not confirm this.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120319")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.