CVE-2026-110113mediumCWE-639

CVE-2026-110113: medium-severity vulnerability in Sanluan PublicCMS

PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint

Published · Updated

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
exploitation probability
0.2%top 85% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Sanluan · PublicCMS
public PoCs found — 1
cve_referencehackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110113-publiccms-trade-address-save-cross-user-overwriteunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Sanluan PublicCMS

In the same product, most dangerous first.

CVE-2026-3289MEDIUMSanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversalEPSS 0.9%CVE-2026-1111MEDIUMSanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversalEPSS 0.7%CVE-2026-8737MEDIUMSanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authenticationEPSS 0.7%CVE-2026-8738MEDIUMSanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic errorEPSS 0.6%CVE-2026-8739MEDIUMSanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded keyEPSS 0.5%CVE-2026-6797MEDIUMSanluan PublicCMS DocToHtmlUtils.java ZipSecureFile.setMinflateRatio resource consumptionEPSS 0.5%
References
https://github.com/sanluan/PublicCMS/blob/V6.202608.a/publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java#L46-L62https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110113-publiccms-trade-address-save-cross-user-overwritehttps://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/publiccms-trade-address-save-cross-user-overwritehttps://www.vulncheck.com/advisories/publiccms-through-v6-202608-a-idor-via-tradeaddress-save-endpoint