---
id: CVE-2026-120319
title: >-
  Sanluan PublicCMS publiccms-trade TradeRefundService.java
  TradeRefundService.updateAmound authorization
summary: >-
  A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the
  function TradeRefundService.updateAmound of the file
  publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java
  of…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-639
  - CWE-285
vendor: Sanluan
product: PublicCMS
affected:
  - PublicCMS 4.*
  - PublicCMS 5.*
  - PublicCMS 6.*
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T15:58:52.750887Z'
published: '2026-11-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:59:11.137Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120319'
references:
  - url: 'https://vuldb.com/vuln/429652'
    label: >-
      VDB-429652 | Sanluan PublicCMS publiccms-trade TradeRefundService.java
      TradeRefundService.updateAmound authorization
  - url: 'https://vuldb.com/vuln/429652/cti'
    label: 'VDB-429652 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-120319'
    label: CVE-2026-120319 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1016201'
    label: 'Submit #1016201 | Sanluan publiccms V5 Authorization Bypass'
tags:
  - cve.org
epss: 0.00269
epssPercentile: 0.19194
ingestedAt: '2026-11-05T22:38:31.319Z'
---

## Overview

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `PublicCMS 4.*`
- `PublicCMS 5.*`
- `PublicCMS 6.*`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.