CVE-2026-110113: PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a PublicCMS member. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What does an attacker need to modify another member's address?
They need another member's shipping-address identifier. The affected handler accepts sequential numeric address IDs and does not verify that the address belongs to the session user or site.
Which address data can be changed?
An attacker can overwrite the addressee, telephone, and address fields of another member's shipping address.
Are deployments affected by default?
The provided information identifies the tradeAddress/save handler as affected, but does not state whether this functionality is enabled or exposed in a default deployment.
How can administrators assess exposure?
Review whether the deployment uses PublicCMS through V6.202608.a and exposes the TradeAddressController tradeAddress/save handler to authenticated members. Test or inspect whether requests can save an address using an ID owned by a different member or site.