---
id: "CVE-2026-120319"
kind: "vulnerability"
aliases: ["CVE-2026-120319"]
title: "PublicCMS: refund update flaw lets remote users bypass authorization"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cms", "e-commerce", "java", "other", "publiccms"]
not_affected_if: ["trade-module-absent"]
published_at: "2026-11-02T02:18:47+00:00"
first_seen_at: "2026-11-02T02:23:37+00:00"
updated_at: "2026-11-02T02:24:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120319", "first_seen_at": "2026-11-02T02:23:37+00:00"}]
---

# PublicCMS: refund update flaw lets remote users bypass authorization

PublicCMS, a Java content management system, has an authorization bypass in its trade refund service, where manipulating the refundId argument skips access checks. A remote attacker could change refund records they should not be able to touch, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the PublicCMS version in use; the affected versions are listed as 4.x, 5.x and 6.x.
- Look for the publiccms-trade module in the deployment and confirm whether the refund feature is enabled.

## Timeline

- 2026-11-02T02:23:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120319

## From the sources

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_