CVE-2026-8738 Details
Description
A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A critical business logic vulnerability has been identified in Sanluan PublicCMS version 5.202506.d, specifically within the trade payment flow. The issue arises in the TradeOrderController.pay, TradePaymentController.pay, and AccountGatewayComponent.pay functions, located in the TradeOrderController.java file. This vulnerability allows anonymous attackers to manipulate payment processes, forcing victims to pay pending orders using their internal account balances. The flaw exists because the application fails to authenticate payment requests or verify ownership of orders and payment records. As a result, an unauthenticated attacker can exploit this vulnerability remotely, leading to unauthorized financial transactions.
To address this vulnerability, PublicCMS should implement the following measures: Require authentication for payment initiation and execution endpoints; enforce server-side authorization checks to ensure the requester owns the order and payment record; change state-altering payment operations from GET to POST; validate CSRF tokens for payment requests; audit other financial endpoints for similar vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 17, 2026CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/809905 | [email protected] | Permission Required |
| https://vuldb.com/vuln/364326 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/364326/cti | [email protected] | Permission Required |
| https://vulnplus-note.wetolink.com/share/ayeMf4xWK0ZZ | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-840 | Business Logic Errors | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sanluan PublicCMS | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 17, 2026 | New CVE Received | [email protected] |