CVE-2026-2010: Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization
A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 7329437e1288540336b1c66c114ed3363adcba02. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2010?
CVE-2026-2010 has a high severity level due to improper authorization in the Paid function, potentially allowing unauthorized actions.
How do I fix CVE-2026-2010?
To fix CVE-2026-2010, update Sanluan PublicCMS to a version later than 6.202506.d that addresses this vulnerability.
What versions of Sanluan PublicCMS are affected by CVE-2026-2010?
CVE-2026-2010 affects Sanluan PublicCMS versions up to and including 4.0.202506.d, 5.202506.d, and 6.202506.d.
What is the nature of the vulnerability in CVE-2026-2010?
CVE-2026-2010 is an improper authorization vulnerability in the TradePaymentService.java file of Sanluan PublicCMS.
Can CVE-2026-2010 lead to data breach?
Yes, CVE-2026-2010 can potentially lead to unauthorized actions that may compromise sensitive data, making it a significant security risk.