{"id":"CVE-2026-120319","kind":"vulnerability","aliases":["CVE-2026-120319"],"related":[],"title":"PublicCMS: refund update flaw lets remote users bypass authorization","description":"A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"PublicCMS, a Java content management system, has an authorization bypass in its trade refund service, where manipulating the refundId argument skips access checks. A remote attacker could change refund records they should not be able to touch, and a public exploit exists.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","e-commerce","java","other","publiccms"],"not_affected_if":["trade-module-absent"],"how_to_check":"- Check the PublicCMS version in use; the affected versions are listed as 4.x, 5.x and 6.x.\n- Look for the publiccms-trade module in the deployment and confirm whether the refund feature is enabled.","fix":null,"status":"open","published_at":"2026-11-02T02:18:47+00:00","first_seen_at":"2026-11-02T02:23:37+00:00","triaged_at":"2026-11-02T02:24:29+00:00","updated_at":"2026-11-02T02:24:29+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-02T02:24:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PublicCMS: refund update flaw lets remote users bypass authorization","impact":"medium","summary":"PublicCMS, a Java content management system, has an authorization bypass in its trade refund service, where manipulating the refundId argument skips access checks. A remote attacker could change refund records they should not be able to touch, and a public exploit exists.","audience":"businesses","category":"other","nicknames":[],"who_cares":["publiccms","java","cms","e-commerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker alters refund records without authorization","analyst_note":"Confirm the affected versions and whether any fix or workaround exists at https://nvd.nist.gov/vuln/detail/CVE-2026-120319; the sources say the vendor did not respond.","how_to_check":"- Check the PublicCMS version in use; the affected versions are listed as 4.x, 5.x and 6.x.\n- Look for the publiccms-trade module in the deployment and confirm whether the refund feature is enabled.\n- unknown for any further check, as the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["trade-module-absent"],"who_is_affected":"Sites running PublicCMS 4.x, 5.x or 6.x with the trade module, which handles refunds. The sources say the vendor did not respond to disclosure, so no patched version is known. Installations without the trade module or refund feature are likely not reached, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4204,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120319':12A,15A '-2026':11A,14A '/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/traderefundservice.java':85C '4':72C 'abl':57B 'access':44B 'affect':75C 'argument':42B,97C 'attack':48B,104C 'author':9A,31B,101C 'bypass':8A,32B,102C 'chang':50B 'check':45B 'cms':16B 'commerc':19B 'compon':88C 'contact':122C 'content':26B 'could':49B,116C 'cve':10A,13A 'disclosur':126C 'e':18B 'e-commerc':17B 'earli':123C 'exist':64B 'exploit':63B,110C 'file':81C 'flaw':4A 'found':68C 'function':77C 'initi':107C 'java':20B,25B 'let':5A 'made':113C 'manag':27B 'manipul':39B,94C 'parent':84C 'perform':92C 'public':62B,114C 'publiccm':1A,22B,23B,71C,83C,90C 'publiccms-par':82C 'publiccms-trad':89C 'record':52B 'refund':2A,36B,51B 'refundid':41B,98C 'remot':6A,47B,108C 'respond':130C 'result':99C 'sanluan':70C 'servic':37B 'skip':43B 'system':28B 'touch':59B 'trade':35B,91C 'traderefundservice.updateamound':78C 'updat':3A 'use':118C 'user':7A 'vendor':120C 'vulner':66C 'way':133C 'x/5.x/6.x':73C","nicknames":[],"mitigations":[],"who_affected":"Sites running PublicCMS 4.x, 5.x or 6.x with the trade module, which handles refunds. The sources say the vendor did not respond to disclosure, so no patched version is known. Installations without the trade module or refund feature are likely not reached, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","ecommerce","java","medium","other","publiccms"],"first_public_at":"2026-11-02T02:18:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120319","severity":null,"published_at":"2026-11-02T02:18:47+00:00","modified_at":"2026-11-02T02:18:47+00:00","first_seen_at":"2026-11-02T02:23:37+00:00","fetched_at":"2026-11-02T02:23:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}