EUVD-2026-98944
GHSA-vpf9-h2mx-wqjf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any member
-
DeliveryEnumerate sequential address ids
-
ExploitSubmit tradeAddress/save with victim id
-
ExecutionOverwrite addressee/telephone/address fields
-
ImpactVictim shipping data corrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated member account on a PublicCMS trade/shop deployment that exposes the tradeAddress/save handler (PR:L in the provided vector). The attacker must know or guess a target's address id, which is feasible because the description states the ids are sequential numeric values, enabling enumeration. Limiting factors: exploitation is confined to modifying (not reading) other members' shipping address records on sites using the publiccms-trade module, and it cannot be performed by a fully unauthenticated attacker; impact is restricted to data integrity of address fields (addressee, telephone, address). |
| Impact | This is a genuine but limited-impact authorization flaw (CWE-639 IDOR), not a high-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 score are consistent with the description: exploitation is network-based and low-complexity but requires an authenticated member session (PR:L), and the only impact is low integrity (VC:N/VI:L/VA:N) - attackers can overwrite another member's addressee, telephone and address fields but cannot read data (no confidentiality impact) or deny service. No EPSS score, KEV listing, or POC/exploit-code signal is present in the input, so there is no evidence of active or automatable exploitation; all signals point to a low-to-moderate, authenticated-only data-integrity issue rather than a widely-exploited critical bug. One data-quality caveat: the input Tag 'Authentication Bypass' conflicts with the actual vulnerability class - CWE-639 and the description describe an authorization/ownership-check failure (IDOR) by an already-authenticated user, not a bypass of authentication. Treat the vulnerability class as authorization bypass, not authentication bypass. |
| Exploit ScenarioDerived | An authenticated member of a PublicCMS trade/shop site logs in and submits a POST to the tradeAddress/save endpoint supplying a sequential numeric address id belonging to another member. Because the controller never verifies that the address belongs to the session user and site, the attacker overwrites that victim's addressee, telephone and shipping address. No public exploit code is identified in the input, but the flaw is trivially reproducible by incrementing the numeric id parameter. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated members on PublicCMS trade/shop deployments can overwrite other members' shipping address records via an insecure direct object reference in the TradeAddressController tradeAddress/save handler. The flaw affects PublicCMS through V6.202608.a and lets an attacker submit another member's sequential numeric address id to change addressee, telephone, and address fields because ownership by the session user and site is never verified. The independent assessment rates it as a genuine but limited-impact CWE-639 integrity flaw (CVSS 3.1 PR:L, I:L, no confidentiality or availability impact), not a high-priority emergency, and no public exploit was identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so the primary fix should be a server-side authorization check in TradeAddressController: before saving, load the address by id and verify that its owner member matches the authenticated session user and that the site matches the current site; reject mismatches with HTTP 403. If code changes are not immediately possible, disable or remove the publiccms-trade module, or block the tradeAddress/save route at the reverse proxy or WAF on deployments that do not need member shipping-address editing; trade-off: this disables legitimate address management and may break checkout flows. Restrict creation of member accounts or trade/shop privileges where untrusted users can register, reducing the pool of authenticated attackers; trade-off: limits legitimate customer onboarding. Do not rely on obscurity of numeric ids alone; if schema changes are feasible, migrate address identifiers to non-sequential values, but that requires application and data migration. Monitor the upstream PublicCMS repository at https://github.com/sanluan/PublicCMS and the VulnCheck advisory at https://www.vulncheck.com/advisories/publiccms-through-v6-202608-a-idor-via-tradeaddress-save-endpoint for a fixed release, then apply the vendor version when available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is CWE-639, Authorization Bypass Through User-Controlled Key, also known as an insecure direct object reference (IDOR). PublicCMS is a Java-based CMS, and the affected code is the publiccms-trade module's TradeAddressController tradeAddress/save handler, referenced in the upstream source at lines 46-62. The save operation accepts a numeric address id from the request and updates address fields without checking that the referenced trade address belongs to the authenticated session member and site. Because address ids are sequential, a legitimate authenticated member can enumerate or guess a target's address id and issue a save request to modify that record. No CPE strings were provided; the affected component is the publiccms-trade module through V6.202608.a. The HackMD write-up and VulnCheck advisory describe the cross-user overwrite path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint and low complexity, but any valid member session suffices so PR:L; only address fields can be altered, giving I:L with no confidentiality or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB