Medium severity · published Oct 13, 2026
CVE-2026-110113
PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
PublicCMS · Sanluan
through V6.202608.a · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110113
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110113
third-party-advisory
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/publiccms-trade-address-save-cross-user-overwrite
technical-description
https://github.com/sanluan/PublicCMS/blob/V6.202608.a/publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java#L46-L62
third-party-advisory
https://www.vulncheck.com/advisories/publiccms-through-v6-202608-a-idor-via-tradeaddress-save-endpoint
More from PublicCMS
6.1
CVE-2025-7953
Sanluan PublicCMS viewer.html redirect
6.1
CVE-2025-7949
Sanluan PublicCMS preview.html redirect
6.1
CVE-2022-3950
sanluan PublicCMS Tab dwz.min.js initLink cross site scripting
5.4
CVE-2024-11070
Sanluan PublicCMS Tag Type save cross site scripting