CVE-2026-6796: PublicCMS Information Disclosure Flaw

CVE-2026-6796 Overview

A cleartext storage vulnerability has been identified in Sanluan PublicCMS up to version 6.202506.d. The vulnerability affects the log_login function within the file core/src/main/java/com/publiccms/controller/admin/LoginAdminController.java, specifically in the Failed Login Handler component. When a failed login attempt occurs, the manipulation of the errorPassword argument results in sensitive password information being stored in cleartext in a file or on disk. This vulnerability can be exploited remotely over the network and poses a risk of sensitive credential exposure.

Critical Impact

Failed login attempts may result in user passwords being stored in cleartext on the server, potentially exposing sensitive authentication credentials to attackers who gain access to system files or logs.

Affected Products

• Sanluan PublicCMS up to version 6.202506.d
• PublicCMS Failed Login Handler component
• LoginAdminController.java login processing module

Discovery Timeline

• 2026-04-21 - CVE-2026-6796 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6796

Vulnerability Analysis

This vulnerability falls under CWE-312 (Cleartext Storage of Sensitive Information). The core issue lies in how the PublicCMS application handles failed authentication attempts. When a user enters incorrect credentials during login, the system's logging mechanism captures the erroneously entered password in plaintext format and writes it to a file or disk storage location.

The vulnerable code path exists within the log_login function of the LoginAdminController.java file. During the normal authentication flow, when credentials fail validation, the error handling routine processes the errorPassword parameter without proper sanitization or encryption, resulting in sensitive password data being persisted in readable form.

This type of information disclosure vulnerability is particularly concerning because it can accumulate a history of password attempts over time. Even if users later successfully authenticate, their previously attempted (and potentially valid for other systems) passwords remain exposed.

Root Cause

The root cause of this vulnerability is improper handling of sensitive authentication data during error logging operations. The log_login function in the Failed Login Handler does not implement adequate data protection measures before writing login failure information to persistent storage. Instead of masking, hashing, or completely omitting the password from log entries, the application stores the errorPassword value in its original cleartext form.

This represents a fundamental secure coding violation where sensitive data handling practices were not followed in the logging subsystem. Proper implementation would require either excluding password data entirely from logs or applying cryptographic transformations before any storage operation.

Attack Vector

The vulnerability is exploitable remotely over the network. An attacker does not need to be authenticated to trigger the vulnerable code path—they simply need to submit failed login attempts to the application. The exploitation scenario proceeds as follows:

1. An attacker identifies a PublicCMS installation running a vulnerable version
2. The attacker submits login attempts (either targeted at specific users or as part of broader credential testing)
3. Each failed attempt causes the entered password to be written to storage in cleartext
4. If the attacker later gains file system access through another vulnerability or compromise, they can retrieve the stored password data
5. Alternatively, if log files are accessible through misconfiguration, directory traversal, or log management systems, the passwords become exposed

The stored cleartext passwords could be used for password reuse attacks against other systems, account takeover, or further privilege escalation within the target environment.

Detection Methods for CVE-2026-6796

Indicators of Compromise

• Presence of plaintext password strings in application log files related to authentication failures
• Log entries in the PublicCMS logging directory containing user-submitted password values
• Unusual file system access patterns targeting log files or authentication-related storage locations
• Evidence of log file exfiltration or unauthorized access to authentication logging storage

Detection Strategies

• Review application log files for the presence of cleartext password data in failed login entries
• Implement file integrity monitoring on directories where authentication logs are stored
• Configure SentinelOne Singularity to monitor for suspicious access patterns to log file locations
• Deploy log analysis rules to detect potential exposure of authentication credentials in application logs

Monitoring Recommendations

• Enable monitoring for file access events targeting the PublicCMS logging directories
• Implement alerting for bulk log file access or exfiltration attempts
• Monitor for privilege escalation attempts that could provide access to protected log storage
• Track authentication failure rates that may indicate credential stuffing or password spraying attempts

How to Mitigate CVE-2026-6796

Immediate Actions Required

• Audit existing log files for cleartext password exposure and securely delete any sensitive data found
• Restrict file system permissions on log directories to prevent unauthorized access
• Implement network segmentation to limit access to systems running vulnerable PublicCMS versions
• Consider taking vulnerable instances offline or restricting login functionality until patched

Patch Information

The vendor (Sanluan) was contacted early about this disclosure but did not respond. As of the last update on 2026-04-22, no official patch has been released. Organizations should monitor the VulDB Vulnerability #358490 entry and vendor channels for patch availability.

In the absence of an official fix, organizations should implement the workarounds below and consider the security implications of continuing to operate vulnerable versions.

Workarounds

• Modify the logging configuration to exclude password-related fields from authentication failure logs
• Implement a custom log filter that masks or removes sensitive authentication data before disk writes
• Enable disk encryption for volumes containing application logs to provide defense-in-depth
• Configure automated log rotation and secure deletion to minimize the exposure window for sensitive data
• Deploy a web application firewall (WAF) to add an additional security layer in front of the application

# Configuration example - Restrict log directory permissions
chmod 600 /path/to/publiccms/logs/
chown publiccms:publiccms /path/to/publiccms/logs/
# Enable encrypted storage for log partition (example using LUKS)
cryptsetup luksFormat /dev/sdX
cryptsetup open /dev/sdX encrypted_logs
mount /dev/mapper/encrypted_logs /path/to/publiccms/logs/