{"id":"CVE-2026-2010","summary":"Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization","details":"A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 7329437e1288540336b1c66c114ed3363adcba02. It is recommended to apply a patch to fix this issue.","modified":"2026-08-12T15:31:30.821510Z","published":"2026-02-06T08:02:09.018Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2010.json","cna_assigner":"VulDB","cwe_ids":["CWE-266","CWE-285"]},"references":[{"type":"WEB","url":"https://github.com/sanluan/PublicCMS/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2010.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2010"},{"type":"ADVISORY","url":"https://vuldb.com/?id.344592"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.743487"},{"type":"REPORT","url":"https://github.com/sanluan/PublicCMS/issues/108"},{"type":"REPORT","url":"https://github.com/sanluan/PublicCMS/issues/108#issue-3838143772"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.344592"},{"type":"FIX","url":"https://github.com/sanluan/PublicCMS/commit/7329437e1288540336b1c66c114ed3363adcba02"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sanluan/publiccms","events":[{"introduced":"0"},{"last_affected":"f85d04e43270b292b502179eb268bffa35380100"},{"introduced":"7dfd5f9a28680dae550f6255787bd98dfebe2fe0"},{"fixed":"7329437e1288540336b1c66c114ed3363adcba02"}],"database_specific":{"cpe":"cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"4.0.202506.d"},{"introduced":"5.202302.a"},{"last_affected":"5.202506.d"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["4.0.202506.a","5.202506.a","6.202506.a","V4.0.202506.e","V4.0.202506.d","V4.0.202506.c","V4.0.202506.b","V4.0.202406.e","V4.0.202406.d","V4.0.202406.c","V4.0.202406.b","V4.0.202406.a","V4.0.202302.a","V4.0.202204.b","V4.0.202204.a","V4.0.190312","V4.0.202107","V4.0.202004","V4.0.181024","V4.0.180707","V2016"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2010.json","vanir_signatures_modified":"2026-08-12T15:31:30Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/cms/CmsContentSourceAdminController.java"},"deprecated":false,"digest":{"line_hashes":["46406114736037373915397753918158646087","96822012220311988633633201392017201754","122976706724114666005523354606352823880","156484033997386444094518287537566461575","104548757563498191393623831589560529731","305440265224001512239478943289693805581","314401315780454351095899312218907276264","323267221535446028461119571965151816676","286065284787145265636823725892296076883","238999125469694718957030416741179979995","220991745736085130081316089879490316574","180027704619916427651810095894324305551","223610429357284236791036460176296125969","140681706157018848290615579552265210719","309553253173779825104501211052448495864"],"threshold":0.9},"id":"CVE-2026-2010-08318a6e","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradePaymentController.java","function":"pay"},"deprecated":false,"digest":{"function_hash":"81862012184387403484670679353699238561","length":704},"id":"CVE-2026-2010-191c2dde"},{"digest":{"line_hashes":["295587740741582724998941098713219034515","157950281863662516265224565047563722900","41764696669023360935061669291543932933","202614212016649100578368074826491885252","323626995808341951540948577747522722892","60062905436166483410263110600708003566","339530893807984955008221405273565680394","143825448631906502063910484381840206437","91455311722116093306238808063273465792","97645760449648546679347702474364674700","228046572261519106256336582872411949096","122047960232184704518074266527105192907","3408498569919265112394182667241974071","75526408662423215926638733550112885928"],"threshold":0.9},"id":"CVE-2026-2010-2663e61a","signature_type":"Line","signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java"},"deprecated":false},{"source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"function":"cancel","file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java"},"deprecated":false,"digest":{"function_hash":"199415631696414851430400831715953251516","length":476},"id":"CVE-2026-2010-26795739","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradePaymentController.java"},"deprecated":false,"digest":{"line_hashes":["138009796738221406309276853926649251914","184367138651867020014013429673248056402","300825506298668918324293574031351095225","55668858307126882319771686745347677327","301124668539485402344166150666342940751","253644821189317905716061505470883703422","276272556166084238796043377234831538625","174293775687870336687211151788437929777","58383759816327430774342750230098903148","24604577670939709140716371124735546583","227629340619719122040256636743261889808","269222799885408561809352055279263148143","59336931607658982906469302598786585655","326639114502382960166152048013204225207","143999837394375417230219666682846678431","75506748245662874900692676089772983590","280233252322565866804189469283441287847","506441053957345933705836275084805609","162581246152878345225107709510900022721","71226028820387157257394582314031042231","235507472317889213372897150680647459343","321396112718126408255286340890879566646","99575583224785199860888672090276474721","135111453097508611291516139176056017549","6751783267688286692544939884623176366","122425993730562549452149090582689913049","4786636393304128815617972094728422010","246332445358117196327902792475524696142","114253810103507157824011259489880564162","67180503711648365028063979906970127101","260247760452484082590395739071635875619","112221115655363977382010649450084938987","30973525797225308837996157522618550146","276800322467084077549584244579624059704","18902802080496891545500155478104467109","256558031947902718895042458996114791857","125933091404204726901417094648258234791","177626602363828759908134235823209423817","326997182917913848006229742794585147142","256419552775014895477383412011431483619","189346120072715114218223503286899279209","165020138882999981155992561410387911575","249545481196304673377221404933440089267","183256143765356029182407353093088882315","153962530053987955763405526040762686342","241913107243675986612070252767092973965","320453018702072030456250360703083363295","76712760512809184921454867890741845599","209600865682399136661656362656756974162","20085790933569118934948176533129229237","339054594206877843969318788063181542189","10707124244064216444738909770003635235","8592865573680826866927463520980096152","290800003975949155068845806211751720431","13763984144533421910760742061506532708","268327471860124447119969670382903942658","22580660512487705518644560083065576344","293542307613805245865792332897960320052","93553139894413121939334156113472769652","306541958942201464783288349881431084140","162484179845134431353296821176749464328","247629508674987783824866600731753633627","28580620180703352622422159972793464859","153679428858976114766586574815905057706","124610983058049085079442512253760760173","176200812909321811207306408095522560727","79071453023682012391566995795412861293","79402033918037179143086805760569873507","330919956689774473957721412519361961117","306968111071845814803012539770581632241","17654301992954885958407411561152039951","22985921756537989712302966031628417446","94294774484966418650208506016708356498","240482023269274697837186642672716758837","68915089296484726966401046377112391889","18743009423763947128670308952810623651","176387360737051750149443055471719742900","337851818707418571916874752887175245798","182067095116917810611438122049190634739","289167248368545603208325382314482565196","246982562685205722958559678051377004377","243312873443684097048488049073813288260","323824601310373967641476498345000007050","327946727150798093034512368419353297084","216593638676299503491894225555805667804","67202738116979326972056845082925530724","180259418745753824457408301408411515823","218001407885721928769551778952988761128","278314454042131668111250393996971264051","256547873871504043374083675612281626430","281626700487016048212682181618413873039","114928135331089545940675475976332829291","233076132265657717440881825650129618824","313574404245743543253260557179098255995","289167248368545603208325382314482565196","96436469191777389373467055725415041831","190696065546108058932804180857282270156","193625194550402514630717117832359371140","244982337321788153346621766562189955705","225574655817555642867609800967803951913","281020001023794179203727427580125010724","290925647177985676054212496468986381842","236248340382792096816441058798799332773","148855833017890032142727771956794688378","246861431605624195164944249025798125319","182586742359968369141480339811966651094","107193538413174576572429862324275336120","323024803392008939601112479833421972860","46738422805086640974797350183892140536","257078896072596537472039307842621570102","340020706366156336950865070521852432400","107366130789583714264051683080540101869","338246991038902641972665602509955066484","244374509666901609798920384833416266105","324813106603326496477275017717646411070","66073420603143646402438196258420656529","31539981743902335846005211690815790463","102547998620102049954841576165379149798","304998577180915229280063686618078812499","42768143477318077156872417867928549243","167764003089613477648552413349692613318","325965359755190689427984217911373312420","328904637557460868184493721032650622788","4673272122883419876100844792818307900","239271322608653567646682689774048070498","201675724850260932675556980777187590583","260355080993463188101948644672365264739","72875407593376699544528278224013994819","270685118087941032973050163177583396136","70993293975436612491652084437780902145","20956794168688985650212628128288057651","56455470103697789201393498606486090279","49760559165237990606250412191627397270","283036792050334130850693511850702284168","10383529020959405031268884058814080286","132039743641183521625109394860732801583","108810031555500501007734154925839141770","135335531543819088345850168307982633481","80886127769166924437097713472132076826","136303330540922701338757818582973513557","295840034001755944347248025354741670584","115387454775520180113342567270029567922","148134504104632468309817909631143279421","193276327306020551292204486260139324310","293814231581449012106060958590566778022","53907784672025374317666348434711390657","48868403374226877946916571687692555397","24720311547816518396002437230797180327","122746902589061501439484698585194823875","165545965004265851501996622715738521442","118163110011980948725097904109338019538","193817546208357628803802963923889715593","271164621424041822675624094863442241322","206873747143647320825848545069348282199","280004227759847432065956483562392481651","81078134790617259845583936302521599588","272602303885836565633809738314500742298","261316047675535393761884598914986994536","281710047828301579339435624424095621520","176744424579677772554801018119220899420","142907827930761868131236394553669753361","44909613708815455627497720051621486667","178185778640465601829991732694826187005","221239316755329185605159377595215417293","151658751509087147431370846059997578702","279159652731133334418873572713070267318","87124703855685495136465518411350968868","265987164814287900215324831157798995627","48793639289792765278447707289472736549","127602573764970022107750593858182149147","135145841077412260311282660075377789136","242676908642214375068439183327411167884","251561062678388468556203661634511089643","57047456938327630508000203585302081376","286861955508055003873258002965589042085","166584426557721521723155653841172609514","205686570304559032830580597465937917748","284170713417125877385766097724874641320","51879730150044734626306211192832198048","85596847534878935616278930280406257623","43152114878079187671739779779709179796","80410681647124478355228237666019636017","44138577003948501181098945084849348028","16707224567478052383651572980313111578","89016151998038578127963662318532476679","74370702664075336814668917714606936358","120680506321163983963423710425094301596","306776593312913460155132392359338554289","301509315344789182066155904658699348960","179838158588885023480366688990629325249","310666205610468255547759923313491761592","151928504740125642677131552492345511000","232877842645975228715357578045839559311","223635952305368214773840556442328276940","155897413180575667269519178601044218569","176882811351155506966373906887080572806","29112427510323142289151386876337546601","205344043038203214577612862404257215541","204876406020179286603383168994006441264","238696874977028094988700636207449983679","219413907422207979518132773296712831552","199384349125512722414774105492451128649","21272047137307976626410232104789762528","202562334768344404084780142944991442644","285739230999637501992274656011706668176","22287878247632754770889584910085898970","90273586498321934690238454573204956516","52600551419572435915683120315688860223","44138577003948501181098945084849348028","174798581471778405560740107185354975409","219188149611794694987621241556926405458","21291712522698143117337998605974999975","212179692583390851782331570233525702991","156556283773267705921036649540960294094","84196252392823725589165196569120920081","225913207389554675314198368993504316068","314322816579335003759606673687637209266","327611080142838011074459793201927627667","301509315344789182066155904658699348960","179838158588885023480366688990629325249","310666205610468255547759923313491761592","151928504740125642677131552492345511000","232877842645975228715357578045839559311","223635952305368214773840556442328276940","188292844031595312570284270429693350461","34558975463597904997420534894006044261","27895754791099841569855129799494334812","8096237819947836783330895649887264696","142749444451120719301134242352533345488","84092411261173777716492551495514619344","122631921886272779755611597764181650529","313599000837969157409326520040666246081","65070018663203423928656640516519029720","259932671295276666866953920174304089224","317997323363640102762697693039482128126","189650979971346878470140814651730854797","277413066266219326840836060634574371365","20429915401059579503527215883314057668","297184095372817105102846843123637781210","186110920387593521536181865319077469998","25018473382601456757441823593840546525","25551348342137462169435211536993471763","183201496173360867023284177673986406296","1048305831172756247476082205350401039","214200974851980245365686422190510130859","318124626566455929031816805747456992208","232898439461842611960435263469812748823","204855742289648779124997976617555866372","321335930507984269387749244767970639655","289626116542750453399599363655349106612","87799585512817207774790142074575822202","245911434811453566185100212581118783223","42493854210104652124796004124844956903","253570431642815047368268828147763640545","205389763829101035258736290524249188946","95620690135641209127529571874946614699","325533297261094045108850783039472331667","49410877286102165727189050417446434092","59285917647752681245186224452805147220","86414740109258219539963892746905212773","270259329271934140286272927151419141324","23315504400789568696283269355802018840","331966829257067201679004569736854102578","225017901151187254183533422023204477478","292271689653392142895449826601554638","119497725668561535434497016390784791705","193890623854497583821028206280927005239","225825467975264269614992166836426038556","127423781893489165273145307382025418321","181071929635775797739263192923612291044","261343276841542546286264143063859074071","192446694752030758725436957776686401253","233271006573943081916743862047844289828","269890526300048431881097110057528049932","263789873173811348049132374676309625336","47289162634345350907333693447586542834","318874782486188393525917787458379869122"],"threshold":0.9},"id":"CVE-2026-2010-2daa640f","signature_type":"Line"},{"id":"CVE-2026-2010-5ff884c2","signature_type":"Line","signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["96600974544215891980248931529565766411","102100129263599115230313211521673418320","145448364405016489408618374580625224261","78964612101581665857601826300059549129","204136369533787250233670991108266040957","19088527324329696596228704751239803121","8133965088313847853402033738488872454","192116109150955622105904963464389056002","44760333079321057080753952734068901820"]}},{"deprecated":false,"digest":{"function_hash":"31385981363952332219691569618958680189","length":1438},"id":"CVE-2026-2010-70f4a915","signature_type":"Function","signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradePaymentController.java","function":"notifyAlipay"}},{"digest":{"function_hash":"184009789103513336669046439684493618402","length":427},"id":"CVE-2026-2010-9d31829a","signature_type":"Function","signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"function":"cancel","file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradePaymentController.java"},"deprecated":false},{"deprecated":false,"digest":{"length":648,"function_hash":"194568634269720115159309754942157956466"},"id":"CVE-2026-2010-b799afa3","signature_type":"Function","signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradePaymentController.java","function":"cancel"}},{"deprecated":false,"digest":{"function_hash":"243013898183358214165228157035891536600","length":5438},"id":"CVE-2026-2010-c5e88f13","signature_type":"Function","signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradePaymentController.java","function":"notifyWechat"}},{"source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradePaymentController.java","function":"refund"},"deprecated":false,"digest":{"function_hash":"313330096743617606398334127444233783231","length":1006},"id":"CVE-2026-2010-d47605a0","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"241513567504926716621462282216279000704","length":972},"id":"CVE-2026-2010-dae80ab8","signature_type":"Function","signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/cms/CmsContentSourceAdminController.java","function":"save"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"4153733207495385900480112843571033377","length":904},"id":"CVE-2026-2010-ea1e16b5","signature_type":"Function","signature_version":"v1","source":"https://github.com/sanluan/publiccms/commit/7329437e1288540336b1c66c114ed3363adcba02","target":{"file":"publiccms-parent/publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java","function":"save"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}