PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint

Advisories

PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint

severity: medium
date: 10/13/2026
Affecting: PublicCMS <= V6.202608.a
CVE: CVE-2026-110113
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/publiccms-trade-address-save-cross-user-overwrite
https://github.com/sanluan/PublicCMS/blob/V6.202608.a/publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java#L46-L62
Credit: hieuPenguinnn
Description: PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo