CVE-2026-120319 | Sanluan PublicCMS 4.x/5.x/6.x publiccms-trade TradeRefundService.java TradeRefundService.updateAmound refundId authorization

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. It has been classified as critical. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass.

This vulnerability is identified as CVE-2026-120319. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More