PublicCMS CVE-2026-97721

Requires an authenticated session to the PublicCMS administrative backend (the vulnerable exportExcel/exportData logic lives in the admin/sys SysUserAdminController). The attacker must be able to reach and invoke the user/department export functionality and then manipulate the userId or deptId request parameter; the server fails to validate that the requested identifier belongs to the caller's authorized scope. Limiting factors: exploitation is gated on possessing valid backend credentials (privilege required per PR in the CVSS vector), impact is confidentiality-only and read-only (no data modification or DoS), and it affects PublicCMS versions up to and including 6.202506.e with no vendor fix available.

This is a low-priority issue despite being remotely reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N/VC:L/VI:N/VA:N) yields a base score of only 2.0, driven by high privilege requirement (PR:H), low confidentiality impact only (VC:L), and no integrity or availability impact - consistent with a read-only IDOR (CWE-639) in an administrative controller. EPSS is not provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; however, a public exploit exists (VulDB-referenced GitHub PoC), so the E:P (Proof-of-Concept) exploit-maturity flag is warranted. The signals are internally consistent: a genuine but narrow authorization-bypass bug affecting an authenticated backend user who can enumerate/manipulate userId/deptId to export data outside their scope. Note the PR level is worth verifying: the flaw sits in an admin/sys export controller and IDOR bugs are typically horizontal escalations reachable by any authenticated backend account, so real-world privilege may be lower than the vendor's PR:H (my independent assessment uses PR:L, which would slightly raise severity). The description also names two controllers inconsistently (CmsContentAdminController referenced but the file is SysUserAdminController.java), a typical VulDB copy-paste artifact - confirm the exact affected endpoint with source.

An authenticated backend user of PublicCMS logs into the admin panel and invokes the exportExcel/exportData functionality, then tampers with the userId or deptId parameter to reference records belonging to other users or departments. Because the server does not enforce ownership/authorization on the supplied identifier, the attacker receives an Excel/data export containing information they should not be able to access. A public proof-of-concept for this parameter manipulation is available on GitHub.