{"id":"CVE-2026-121583","kind":"vulnerability","aliases":["CVE-2026-121583"],"related":[],"title":"PublicCMS 5: pending refund check lets a user act on other accounts","description":"A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437).","summary":"PublicCMS 5 has an authorization bypass in the trade payment refund logic, where the userId argument is not properly checked. A remote attacker can use it to act on another user's pending refund.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","java","publiccms","runtime"],"not_affected_if":["202608-or-later","trade-module-disabled"],"how_to_check":"- Look for the file `publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java` in your PublicCMS 5 deployment.\n- Check the PublicCMS version in use; the sources say the web trade payment controller was removed starting with the 202608 series.","fix":"- Move to the 202608 series or later, where the web trade payment controller was removed (commit 7329437). Exact fixed version: unknown.","status":"open","published_at":"2026-11-04T00:17:26+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","triaged_at":"2026-11-04T00:47:56+00:00","updated_at":"2026-11-04T00:47:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-04T00:47:56Z","model":"claude-haiku-5-5","output":{"fix":"- Move to the 202608 series or later, where the web trade payment controller was removed (commit 7329437). Exact fixed version: unknown.","reach":"internet","title":"PublicCMS 5: pending refund check lets a user act on other accounts","impact":"medium","summary":"PublicCMS 5 has an authorization bypass in the trade payment refund logic, where the userId argument is not properly checked. A remote attacker can use it to act on another user's pending refund.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["publiccms","java","e-commerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker manipulates refunds belonging to other users.","analyst_note":"Confirm the affected version range and whether authentication is required; check the NVD entry and the commit 7329437 for the exact fixed version.","how_to_check":"- Look for the file `publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java` in your PublicCMS 5 deployment.\n- Check the PublicCMS version in use; the sources say the web trade payment controller was removed starting with the 202608 series.","plain_action":"","needs_analyst":true,"not_affected_if":["202608-or-later","trade-module-disabled"],"who_is_affected":"Sites running PublicCMS 5 with the trade module, where refunds are handled through the web trade payment controller. Sites on the 202608 series or later, where that controller was removed, are not affected by the cited code path. Whether the module is enabled by default is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4182,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121583':15A,18A '-2026':14A,17A '/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/tradepaymentservice.java':78C '202608':117C '5':2A,26B,66C '7329437':120C 'account':12A 'act':9A,52B 'affect':68C 'anoth':54B 'argument':40B,83C 'attack':47B,90C 'author':29B,87C 'avail':102C 'bypass':30B,88C 'carri':95C 'check':5A,44B 'commerc':21B 'commit':119C 'control':111C 'cve':13A,16A 'e':20B 'e-commerc':19B 'exploit':99C 'file':74C 'function':70C 'identifi':62C 'java':22B 'lead':85C 'let':6A 'logic':36B 'manipul':80C 'might':104C 'parent':77C 'payment':34B,110C 'pend':3A,57B 'possibl':92C 'proper':43B 'public':101C 'publiccm':1A,23B,25B,65C,76C 'publiccms-par':75C 'refund':4A,35B,58B 'remot':46B,97C 'remov':113C 'runtim':24B 'sanluan':64C 'seri':118C 'start':114C 'trade':33B,109C 'tradepaymentservice.pendingrefund':71C 'use':49B,106C 'user':8A,55B 'userid':39B,84C 'vulner':60C 'web':108C","nicknames":[],"mitigations":[],"who_affected":"Sites running PublicCMS 5 with the trade module, where refunds are handled through the web trade payment controller. Sites on the 202608 series or later, where that controller was removed, are not affected by the cited code path. Whether the module is enabled by default is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","java","medium","publiccms","runtime"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121583","severity":null,"published_at":"2026-11-04T00:17:26+00:00","modified_at":"2026-11-04T00:17:26+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","fetched_at":"2026-11-04T00:46:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}