CVE-2026-1112
Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jan 18, 2026
- Updated
- Feb 23, 2026
- Reserved
- Jan 17, 2026
Description
A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java of the component Trade Address Deletion Endpoint. Performing a manipulation of the argument ids results in improper authorization. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.4 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.5 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
PublicCMSSanluan |
|
References
- VDB-341704 | Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorizationvdb-entrytechnical-description
- VDB-341704 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #732771 | publiccms PublicCMS <= V5.202506.d Insecure Direct Object Reference (IDOR)third-party-advisory
- https://github.com/AnalogyC0de/public_exp/issues/4exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.