CVE-2026-2010 | Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d Trade Payment TradePaymentService.java paid paymentId improper authorization (Issue 108)

A vulnerability identified as critical has been detected in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization.

This vulnerability is documented as CVE-2026-2010. The attack can be initiated remotely. Additionally, an exploit exists.

It is recommended to apply a patch to fix this issue.