CVE-2026-121583: Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization
A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437).
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack is remote and requires low-privileged access. No user interaction is required, and exploitation involves manipulating the userId argument passed to the pendingRefund function.
Which deployments are most exposed?
PublicCMS 5 deployments that expose the web trade payment functionality are affected by the vulnerable code path. The data does not state whether this functionality is enabled by default.
What can be done if the affected code cannot be patched immediately?
Restrict access for low-privileged users to the web trade payment functionality and review authorization around refund operations. The web trade payment controller was removed beginning with the 202608 series in commit 7329437.
How can I determine whether my instance still contains the affected path?
Check whether the deployment includes TradePaymentService.pendingRefund and the web trade payment controller. Deployments based on the 202608 series or later can also be checked for commit 7329437, which removed that controller.