Live › vulnerability › CVE-2026-121583
PublicCMS 5 has an authorization bypass in the trade payment refund logic, where the userId argument is not properly checked. A remote attacker can use it to act on another user's pending refund.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Sites running PublicCMS 5 with the trade module, where refunds are handled through the web trade payment controller. Sites on the 202608 series or later, where that controller was removed, are not affected by the cited code path. Whether the module is enabled by default is unknown.
No product ranges from the sources yet.
publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java in your PublicCMS 5 deployment.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437).
This page as .md · .json · in your agent: get_signal("CVE-2026-121583")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.