CVE-2026-1112: PublicCMS Auth Bypass Vulnerability

CVE-2026-1112 Overview

A significant improper authorization vulnerability has been identified in Sanluan PublicCMS affecting versions up to 5.202506.d. The vulnerability exists in the delete function within the Trade Address Deletion Endpoint, specifically in the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java. By manipulating the ids argument, an attacker can bypass authorization controls and perform unauthorized deletions of trade address records. This vulnerability can be exploited remotely over the network and a public exploit is available.

Critical Impact

Authenticated attackers can exploit improper authorization controls to delete trade address records belonging to other users, potentially disrupting e-commerce operations and causing data integrity issues.

Affected Products

• Sanluan PublicCMS versions up to 5.202506.d
• PublicCMS Trade module (publiccms-trade)
• Trade Address Controller component

Discovery Timeline

• 2026-01-18 - CVE-2026-1112 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-1112

Vulnerability Analysis

This vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), which falls under the category of improper authorization vulnerabilities. The core issue lies in the TradeAddressController.java file, where the delete function fails to properly validate whether the authenticated user has authorization to delete the specified trade address records.

When processing deletion requests, the endpoint accepts an ids parameter that identifies which trade address records to remove. However, the application does not verify that the requesting user owns or has permission to delete the specified addresses. This allows any authenticated user to delete trade addresses belonging to other users by simply manipulating the ids parameter in their requests.

The vulnerability enables horizontal privilege escalation, where users can affect resources belonging to other users at the same privilege level. While the attack requires authentication (low privileges), it can be executed remotely without user interaction, making it a practical attack vector for malicious actors with valid credentials.

Root Cause

The root cause of this vulnerability is insufficient authorization checks in the delete function of the TradeAddressController class. The application accepts user-supplied ids values and processes deletion requests without verifying ownership or authorization rights. This represents a classic Insecure Direct Object Reference (IDOR) pattern, where object identifiers are exposed to users without proper access control validation.

Attack Vector

The attack can be initiated remotely by any authenticated user of the PublicCMS system. The attacker would:

1. Authenticate to the PublicCMS application with valid credentials
2. Identify the Trade Address Deletion Endpoint
3. Craft a malicious request with manipulated ids parameter values targeting other users' trade addresses
4. Submit the deletion request to remove unauthorized records

The vulnerability has been publicly disclosed with exploit details available in the GitHub Issue Report. The attack requires network access and low-level authentication but no user interaction, making it relatively straightforward to exploit.

Detection Methods for CVE-2026-1112

Indicators of Compromise

• Unusual patterns of trade address deletion requests from single user accounts
• Deletion requests targeting multiple disparate user IDs in rapid succession
• HTTP requests to the Trade Address Deletion Endpoint with bulk ids parameters
• Log entries showing users deleting addresses they did not create

Detection Strategies

• Monitor application logs for deletion operations in TradeAddressController where the requesting user does not match the owner of the target records
• Implement alerting on bulk deletion requests (multiple ids in single request) to the trade address endpoint
• Deploy web application firewall (WAF) rules to flag suspicious parameter manipulation patterns
• Enable detailed audit logging for all CRUD operations in the trade module

Monitoring Recommendations

• Establish baseline metrics for normal trade address deletion frequency per user
• Configure real-time alerts for deletion volume anomalies that exceed typical patterns
• Review application access logs regularly for unauthorized access attempts to the trade endpoints
• Implement database triggers to log all trade address deletions with requesting user context

How to Mitigate CVE-2026-1112

Immediate Actions Required

• Audit all trade address deletion activity for signs of unauthorized access or data manipulation
• Restrict access to the Trade Address Deletion Endpoint to only essential users until patched
• Implement application-level access controls to verify ownership before processing deletion requests
• Review and remove any unauthorized user accounts that may have exploited this vulnerability

Patch Information

The vendor (Sanluan) was contacted about this vulnerability but did not respond. No official patch information is currently available. Organizations should implement the workarounds below and monitor for vendor updates. Additional technical details and vulnerability tracking information are available through VulDB #341704.

Workarounds

• Implement a custom authorization filter to verify that users can only delete their own trade addresses
• Add server-side validation in TradeAddressController.java to check ownership before processing deletions
• Deploy a reverse proxy or WAF rule to restrict access to the vulnerable endpoint
• Consider disabling the trade address deletion functionality entirely until a proper fix is available

# Example: Add IP-based access restriction to trade endpoints in web server config
# Apache configuration example
<Location "/publiccms/trade/address/delete">
    Require ip 10.0.0.0/8 192.168.0.0/16
    # Restrict to internal network until vulnerability is patched
</Location>