Description
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
Published: 2026-10-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authenticated users modifying other users' shipping addresses
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an insecure direct object reference in the TradeAddressController tradeAddress/save handler that allows an authenticated user to modify another member's shipping address by supplying a numeric address ID that does not belong to them. This flaw permits overwriting of address fields, including addressee, telephone and address data, effectively allowing an attacker to tamper with other users' shipping information.

Affected Systems

PublicCMS version V6.202608.a, developed by Sanluan, is affected. No other product or vendor is listed.

Risk and Exploitability

The CVSS v3 score is 5.3, placing this flaw in the medium severity range. Exploit probability is not reported, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with a user account to use the flaw, but no special privilege or additional access is required once logged in. The lack of proper ownership verification allows the attacker to overwrite any shipping address belonging to any user with sequential numeric IDs.

Generated by OpenCVE AI on October 13, 2026 at 19:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PublicCMS to the latest release that contains the fix for the tradeAddress IDOR
  • Verify that the tradeAddress/save endpoint checks ownership of the address ID against the authenticated user before making any updates
  • Enable comprehensive audit logging for all address modifications and regularly review the logs for unauthorized changes

Generated by OpenCVE AI on October 13, 2026 at 19:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
References

Wed, 14 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Sanluan
Sanluan publiccms
Vendors & Products Sanluan
Sanluan publiccms

Tue, 13 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
Title PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
First Time appeared Publiccms
Publiccms publiccms
Weaknesses CWE-639
CPEs cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*
Vendors & Products Publiccms
Publiccms publiccms
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Publiccms Publiccms
Sanluan Publiccms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T22:16:59.627Z

Reserved: 2026-10-13T16:22:55.958Z

Link: CVE-2026-110113

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-13T17:17:35.363

Modified: 2026-10-16T23:16:59.177

Link: CVE-2026-110113

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T23:45:17Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key