CVE-2026-110113: PublicCMS Auth Bypass Vulnerability

CVE-2026-110113 Overview

CVE-2026-110113 is an Insecure Direct Object Reference (IDOR) vulnerability in PublicCMS through version V6.202608.a. The flaw resides in the TradeAddressController component, specifically in the tradeAddress/save handler. The handler accepts a sequential numeric address identifier from authenticated members without verifying that the referenced address belongs to the current session user or site.

Authenticated members can submit another member's address id and overwrite the stored addressee, telephone, and address fields. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Any authenticated member can tamper with any other member's shipping address data, enabling shipment redirection and personal data corruption across tenants.

Affected Products

• PublicCMS through version V6.202608.a
• publiccms-trade module containing TradeAddressController
• Deployments exposing the tradeAddress/save web endpoint to member sessions

Discovery Timeline

• 2026-10-13 - CVE-2026-110113 published to the National Vulnerability Database
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-110113

Vulnerability Analysis

PublicCMS is an open-source Java content management system. The publiccms-trade module adds e-commerce features, including per-member shipping address management handled by TradeAddressController. The tradeAddress/save endpoint persists address records keyed by a sequential numeric primary key.

When an authenticated member submits a save request, the controller trusts the client-supplied id parameter and loads the matching record for update. The code path does not compare the loaded record's owning userId or siteId against the active session principal. As a result, the update proceeds against any address row referenced by id, regardless of ownership.

An attacker only needs a valid member session on the target site. Because address identifiers are sequential integers, enumeration is trivial. The resulting write affects attacker-controlled fields that drive physical shipment, including recipient name, phone number, and street address.

Root Cause

The root cause is missing object-level authorization in the save handler. The controller performs authentication but omits the authorization check that binds a resource to its owner. This is the canonical pattern described by CWE-639 and the OWASP API Security Top 10 category for Broken Object Level Authorization.

Attack Vector

Exploitation requires network access to the member-facing site and a low-privileged member account. The attacker authenticates, then issues a POST to tradeAddress/save with a target victim's address id and attacker-chosen values for addressee, telephone, and address. The server overwrites the record and returns a success response.

For the exact vulnerable source lines, see the GitHub source code file and the HackMD cross-user overwrite guide.

Detection Methods for CVE-2026-110113

Indicators of Compromise

• Unexpected modifications to trade_address records where the row's historical user_id does not match the session user that issued the latest update.
• Spikes in POST requests to tradeAddress/save from a single member session referencing many different numeric id values.
• Shipping address fields updated to recipient names, phone numbers, or street addresses that do not correlate with the owning member's profile.

Detection Strategies

• Add server-side audit logging on TradeAddressController.save that records the submitted id, the resolved record owner, and the session user, then alert when they differ.
• Deploy a Web Application Firewall (WAF) rule that tracks per-session access patterns to tradeAddress/save and flags enumeration of sequential id values.
• Run periodic database integrity checks comparing the user_id on each trade_address row against the user that last modified it.

Monitoring Recommendations

• Forward application and database audit logs to a central analytics platform and correlate address writes with session identity.
• Monitor outbound order fulfillment data for sudden recipient or address changes immediately before order placement.
• Baseline normal tradeAddress/save request volume per member and alert on deviations.

How to Mitigate CVE-2026-110113

Immediate Actions Required

• Restrict public access to the tradeAddress/save endpoint until a patched build is deployed, for example by disabling the trade module on exposed sites.
• Add an authorization check in TradeAddressController that loads the existing record and verifies both siteId and userId against the session principal before applying updates.
• Review trade_address rows for unauthorized modifications and restore known-good values from backups where tampering is identified.

Patch Information

No vendor patch is referenced in the advisory data at publication. Track the VulnCheck advisory on PublicCMS and the upstream PublicCMS repository for a fixed release beyond V6.202608.a. Until a fix is available, apply a local source modification that enforces ownership on the save handler.

Workarounds

• Introduce a server-side filter that rejects any tradeAddress/save request where the referenced record's userId does not equal the authenticated session user.
• Replace sequential numeric address identifiers with unguessable values such as UUIDs to raise the cost of enumeration while the authorization fix is being developed.
• Rate-limit tradeAddress/save on a per-session basis to slow mass overwrites and give detection controls time to trigger.

# Example reverse-proxy rate limit for the vulnerable endpoint (nginx)
limit_req_zone $binary_remote_addr zone=tradeaddr:10m rate=5r/m;

location /tradeAddress/save {
    limit_req zone=tradeaddr burst=5 nodelay;
    proxy_pass http://publiccms_backend;
}