{"id":"CVE-2026-120319","title":"Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization","summary":"A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-639","CWE-285"],"vendor":"Sanluan","product":"PublicCMS","affected":["PublicCMS 4.*","PublicCMS 5.*","PublicCMS 6.*"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T15:58:52.750887Z"},"published":"2026-11-02","updated":"2026-11-05","sourceUpdated":"2026-11-05T15:59:11.137Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120319","references":[{"url":"https://vuldb.com/vuln/429652","label":"VDB-429652 | Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization"},{"url":"https://vuldb.com/vuln/429652/cti","label":"VDB-429652 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-120319","label":"CVE-2026-120319 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1016201","label":"Submit #1016201 | Sanluan publiccms V5 Authorization Bypass"}],"tags":["cve.org"],"epss":0.00269,"epssPercentile":0.19194,"ingestedAt":"2026-11-05T22:38:31.319Z","slug":"CVE-2026-120319","body":"## Overview\n\nA vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\n## Affected\n\n- `PublicCMS 4.*`\n- `PublicCMS 5.*`\n- `PublicCMS 6.*`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}