CVE-2026-97721: Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization
A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of the component exportExcel/exportData. This manipulation of the argument userId/deptId causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges, as indicated by the PR:H vector component. The attack can be initiated remotely and does not require user interaction.
What access can the attacker gain?
The issue allows authorization bypass through manipulation of the userId or deptId argument in the exportExcel/exportData functionality. The reported impact is limited to confidentiality, with low confidentiality impact and no reported integrity or availability impact.
Which versions are affected?
Sanluan PublicCMS versions up to 6.202506.e are identified as affected.
Is public exploitation a concern?
Yes. An exploit has been made publicly available, and the vendor reportedly did not respond to early disclosure contact.