CVE-2026-1112 | Sanluan PublicCMS up to 5.202506.d Trade Address Deletion Endpoint TradeAddressController.java delete ids improper authorization

A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. It has been classified as critical. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java of the component Trade Address Deletion Endpoint. Performing a manipulation of the argument ids results in improper authorization.

This vulnerability was named CVE-2026-1112. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.