Is there a public PoC exploit available for CVE-2026-8737?

Yes, a public proof-of-concept exploit is available for CVE-2026-8737. Prioritise patching immediately. EPSS: 0.0%.

Sanluan PublicCMS CVE-2026-8737

Q: What is the CVSS score of CVE-2026-8737?

CVE-2026-8737 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30686 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-05-17 VulDB

GHSA-cm9c-h987-49f4

Authentication Bypass Java

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 17, 2026 - 07:29 vuln.today

CVSS changed

May 17, 2026 - 07:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A weakness has been identified in Sanluan PublicCMS 5.202506.d. This issue affects the function execute of the file publiccms-trade/src/main/java/com/publiccms/views/directive/trade/TradeAddressListDirective.java of the component Trade Address Query Handler. Executing a manipulation of the argument userId/id can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authentication bypass in Sanluan PublicCMS 5.202506.d allows remote unauthenticated attackers to access arbitrary user trade address data via manipulation of userId/id parameters in the TradeAddressListDirective component. Public exploit code exists (CVSS E:P), enabling unauthorized disclosure of confidential address information including names, phone numbers, and shipping details. EPSS data unavailable; not listed in CISA KEV. Vendor non-responsive to disclosure.

Technical ContextAI

The vulnerability exists in the TradeAddressListDirective.java component of the publiccms-trade module, which handles e-commerce trade address queries. CWE-306 (Missing Authentication for Critical Function) indicates the execute() function fails to validate user identity before processing address lookup requests. The flaw allows direct parameter manipulation of userId and id fields without requiring session authentication or authorization checks. PublicCMS is a Java-based open-source content management system with integrated e-commerce capabilities. The affected CPE cpe:2.3:a:sanluan:publiccms:*:*:*:*:*:*:*:* indicates the vulnerability impacts the core PublicCMS product, though specific version range beyond 5.202506.d is not confirmed in available data.

RemediationAI

No vendor-released patch identified at time of analysis - maintainer non-responsive per VulDB submission 809885. Immediate compensating controls: (1) Disable or restrict network access to the TradeAddressListDirective endpoint at /publiccms-trade/ paths via web application firewall rules, trading off trade address lookup functionality for security. (2) Implement authentication middleware layer enforcing session validation before routing to trade module endpoints, requiring custom code changes with risk of breaking existing integrations. (3) Deploy input validation filtering userId/id parameters to only allow authenticated user's own ID, preventing lateral enumeration but requiring source code modification. (4) Monitor application logs for abnormal trade address query patterns (high volume, sequential ID enumeration) as detection control. Long-term: consider migration to maintained CMS platform given vendor unresponsiveness. Community patches may emerge at https://github.com/sanluan/PublicCMS/issues but are not confirmed. Reference VulDB advisory at https://vuldb.com/vuln/364325 and exploit analysis at https://vulnplus-note.wetolink.com/share/VqmGhijVKGBM for technical details.