Description
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
Published: 2026-10-13
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Authenticated users modifying other users' shipping addresses
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an insecure direct object reference in the TradeAddressController tradeAddress/save handler that allows an authenticated user to modify another member's shipping address by supplying a numeric address ID that does not belong to them. This flaw permits overwriting of address fields, including addressee, telephone and address data, effectively allowing an attacker to tamper with other users' shipping information.

Affected Systems

PublicCMS version V6.202608.a, developed by Sanluan, is affected. No other product or vendor is listed.

Risk and Exploitability

The CVSS v3 score is 5.3, placing this flaw in the medium severity range. Exploit probability is not reported, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with a user account to use the flaw, but no special privilege or additional access is required once logged in. The lack of proper ownership verification allows the attacker to overwrite any shipping address belonging to any user with sequential numeric IDs.

Generated by OpenCVE AI on October 13, 2026 at 19:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PublicCMS to the latest release that contains the fix for the tradeAddress IDOR
  • Verify that the tradeAddress/save endpoint checks ownership of the address ID against the authenticated user before making any updates
  • Enable comprehensive audit logging for all address modifications and regularly review the logs for unauthorized changes

Generated by OpenCVE AI on October 13, 2026 at 19:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
Title PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
First Time appeared Publiccms
Publiccms publiccms
Weaknesses CWE-639
CPEs cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*
Vendors & Products Publiccms
Publiccms publiccms
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Publiccms Publiccms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T16:53:12.086Z

Reserved: 2026-10-13T16:22:55.958Z

Link: CVE-2026-110113

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T17:17:35.363

Modified: 2026-10-13T17:17:35.363

Link: CVE-2026-110113

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T19:15:08Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key