PublicCMS CVE-2026-121583

Requires a valid authenticated low-privileged account (PR:L) on a PublicCMS 5 instance where the trade/payment module is deployed and the web trade payment controller is reachable. The specific trigger is manipulation of the userId argument passed to TradePaymentService.pendingRefund, causing the function to operate on another user's refund context without verifying ownership. Limiting factors: exploitation is gated by authentication, by the presence/enablement of the trade payment feature, and by version - the vulnerable web trade payment controller was removed starting with the 202608 series (commit 7329437), so instances at or beyond that series are not affected.

All severity signals point to a LOW real-world priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 2.1, and the vuln.today Decision label is 'monitor' - the lowest actionable tier. The PR:L metric confirms exploitation is authenticated: an attacker needs a valid low-privileged account on the PublicCMS trade module before manipulating the userId argument. Impact is bounded to Low across confidentiality and integrity, consistent with an IDOR-style authorization bypass (CWE-285) over trade/refund records rather than system compromise. The E:P threat metric and the VulDB statement that an exploit is public indicate a proof-of-concept exists, but this is NOT in CISA KEV and no EPSS score is provided, so there is no evidence of widespread or automated exploitation. No signals conflict; they consistently describe a low-impact, authentication-gated flaw in a niche product. Note one metadata caveat: the input Tags say 'Authentication Bypass,' but CWE-285 and the description ('authorization bypass') describe an AUTHORIZATION bypass - verify classification with the source, as it changes the control that mitigates it.

A registered low-privileged user of a PublicCMS 5 deployment running the trade/payment module sends a crafted request to the TradePaymentService.pendingRefund function, substituting another account's value for the userId argument. Because the function does not verify that the caller owns the referenced record (CWE-285), the attacker reads or acts on another user's pending-refund data. A public PoC reference is cited by VulDB, and the low attack complexity (AC:L) means the manipulation is a simple parameter change, though a valid authenticated session is required.