CVE-2026-2010
📋 TL;DR
This CVE describes an improper authorization vulnerability in Sanluan PublicCMS's trade payment handler. Attackers can manipulate payment IDs to bypass authorization checks, potentially accessing unauthorized payment data or functions. Affected users are those running PublicCMS versions up to 4.0.202506.d, 5.202506.d, or 6.202506.d with the trade payment component enabled.
💻 Affected Systems
- Sanluan PublicCMS
📦 What is this software?
Publiccms by Publiccms
Publiccms by Publiccms
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to payment data, manipulation of payment transactions, or financial fraud.
Likely Case
Unauthorized viewing of payment information or limited manipulation of payment records.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure.
🎯 Exploit Status
Exploit requires understanding of payment ID manipulation and authorization bypass techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 7329437e1288540336b1c66c114ed3363adcba02
Vendor Advisory: https://github.com/sanluan/PublicCMS/issues/108
Restart Required: Yes
Instructions:
1. Pull latest code from GitHub repository 2. Apply commit 7329437e1288540336b1c66c114ed3363adcba02 3. Rebuild and redeploy application 4. Restart PublicCMS service
🔧 Temporary Workarounds
Disable Trade Payment Component
allTemporarily disable the vulnerable trade payment handler if not required
Modify configuration to disable com.publiccms.logic.service.trade.TradePaymentService
Network Access Restriction
allRestrict network access to the payment endpoint
Configure firewall rules to limit access to /trade/payment endpoints
🧯 If You Can't Patch
- Implement strict input validation for paymentId parameter
- Add additional authorization checks before processing payment operations
🔍 How to Verify
Check if Vulnerable:
Check if running PublicCMS version 4.0.202506.d, 5.202506.d, or 6.202506.d with trade payment enabledCheck Version:
Check PublicCMS version in admin panel or application propertiesVerify Fix Applied:
Verify commit 7329437e1288540336b1c66c114ed3363adcba02 is applied in codebase📡 Detection & Monitoring
Log Indicators:
- Unusual payment ID patterns
- Failed authorization attempts on payment endpoints
- Access to payment data from unauthorized users
Network Indicators:
- Unusual requests to /trade/payment endpoints
- Manipulation of paymentId parameter in requests
SIEM Query:
source="publiccms" AND (uri_path="/trade/payment" OR uri_path="/trade/*") AND (status_code=200 OR status_code=403) AND user_agent NOT IN ["expected_user_agents"]🔗 References
- https://github.com/sanluan/PublicCMS/
- https://github.com/sanluan/PublicCMS/commit/7329437e1288540336b1c66c114ed3363adcba02
- https://github.com/sanluan/PublicCMS/issues/108
- https://github.com/sanluan/PublicCMS/issues/108#issue-3838143772
- https://vuldb.com/?ctiid.344592
- https://vuldb.com/?id.344592
- https://vuldb.com/?submit.743487
