CVE-2026-116274 Details
Description
A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability allowing improper authorization has been identified in JIZHICMS versions through 2.5.6. The issue resides in the OrderController.php file, specifically within the Pay function of the Front-end Order Handler component. The vulnerability arises because the order lookup is based solely on a client-supplied order number, without verifying if the order belongs to the authenticated user. This flaw enables an authenticated user to manipulate order details of other users. The vulnerability can be exploited remotely, and has been publicly disclosed.
To address this vulnerability, the order lookup should be modified to include a check for the authenticated user's ID, ensuring that only orders belonging to the user can be accessed and modified. This change should be applied to all order-related operations that alter order states.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/riyuedeqi/jizhicms-order-idor | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-116274 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1011003 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426303 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426303/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JIZHICMS | >= 2.4.5, <= 2.5.6 (semver) 2.0 HEAD ff2c965c26018ae7c3fdb70f180a3b76f40bc3fe |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |