---
id: "CVE-2026-121583"
kind: "vulnerability"
aliases: ["CVE-2026-121583"]
title: "PublicCMS 5: pending refund check lets a user act on other accounts"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["e-commerce", "java", "publiccms", "runtime"]
not_affected_if: ["202608-or-later", "trade-module-disabled"]
published_at: "2026-11-04T00:17:26+00:00"
first_seen_at: "2026-11-04T00:46:17+00:00"
updated_at: "2026-11-04T00:47:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121583", "first_seen_at": "2026-11-04T00:46:17+00:00"}]
---

# PublicCMS 5: pending refund check lets a user act on other accounts

PublicCMS 5 has an authorization bypass in the trade payment refund logic, where the userId argument is not properly checked. A remote attacker can use it to act on another user's pending refund.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the file `publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java` in your PublicCMS 5 deployment.
- Check the PublicCMS version in use; the sources say the web trade payment controller was removed starting with the 202608 series.

## Fix

- Move to the 202608 series or later, where the web trade payment controller was removed (commit 7329437). Exact fixed version: unknown.

## Timeline

- 2026-11-04T00:46:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121583

## From the sources

A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_