---
id: CVE-2026-121583
title: >-
  Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund
  authorization
summary: >-
  A vulnerability was identified in Sanluan PublicCMS 5. This affects the
  function TradePaymentService.pendingRefund of the file
  publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java.
  The…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-639
  - CWE-285
vendor: Sanluan
product: PublicCMS
affected:
  - PublicCMS 5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T18:58:25.527271Z'
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:58:33.890Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121583'
references:
  - url: 'https://vuldb.com/vuln/430428'
    label: >-
      VDB-430428 | Sanluan PublicCMS TradePaymentService.java
      TradePaymentService.pendingRefund authorization
  - url: 'https://vuldb.com/vuln/430428/cti'
    label: 'VDB-430428 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-121583'
    label: CVE-2026-121583 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1020265'
    label: 'Submit #1020265 | Sanluan publiccms V5 Authorization Bypass'
tags:
  - cve.org
epss: 0.00285
epssPercentile: 0.21129
ingestedAt: '2026-11-05T21:36:00.514Z'
---

## Overview

A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437).

## Affected

- `PublicCMS 5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.