CVE-2026-121583 | Sanluan PublicCMS 5 TradePaymentService.java TradePaymentService.pendingRefund userId authorization

A vulnerability marked as critical has been reported in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass.

This vulnerability is uniquely identified as CVE-2026-121583. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The web trade payment controller was removed starting with the 202608 series (commit 7329437).VulDB Recent EntriesRead More