CVE-2026-116274: JIZHICMS Front-end Order OrderController.php pay improper authorization

Q: Who can exploit this issue?

An attacker needs at least low-level privileges and can launch the attack remotely. No user interaction is required.

Q: What does an attacker manipulate to trigger the vulnerability?

The vulnerable Pay function in app/home/c/OrderController.php improperly authorizes requests based on the orderno argument. Manipulating that argument can lead to an authorization failure affecting order handling.

Q: Which versions are affected?

JIZHICMS versions up to and including 2.5.6 are affected, based on the available information.

Q: Is public exploit information available?

Yes. The exploit has been publicly disclosed and may be used.

Q: Is a vendor fix available?

The available information does not identify a fix. It states that the vendor was contacted early about the disclosure but did not respond.

Published Oct 26, 2026

Updated

A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Jizhicms JIZHICMS<=2.5.6

Event History

Oct 26, 2026

CVE Published

via MITRE·12:15 PM

Data Sourced

via MITRE·12:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs at least low-level privileges and can launch the attack remotely. No user interaction is required.

What does an attacker manipulate to trigger the vulnerability?

The vulnerable Pay function in app/home/c/OrderController.php improperly authorizes requests based on the orderno argument. Manipulating that argument can lead to an authorization failure affecting order handling.

Which versions are affected?

JIZHICMS versions up to and including 2.5.6 are affected, based on the available information.

Is public exploit information available?

Yes. The exploit has been publicly disclosed and may be used.

Is a vendor fix available?

The available information does not identify a fix. It states that the vendor was contacted early about the disclosure but did not respond.

CVE-2026-116274: JIZHICMS Front-end Order OrderController.php pay improper authorization

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker manipulate to trigger the vulnerability?

Which versions are affected?

Is public exploit information available?

Is a vendor fix available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker manipulate to trigger the vulnerability?

Which versions are affected?

Is public exploit information available?

Is a vendor fix available?