Security readout for executives and security teams
Plain-English summary
CVE-2026-1112 affects Sanluan PublicCMS trade address deletion. An authenticated remote user may manipulate an address identifier and delete or affect trade address records they should not control. Business impact is likely limited to integrity and availability of address data, not data theft, based on the published CVSS details.
Executive priority
Treat as a medium-priority remediation item. Prioritize if PublicCMS trade functionality is internet-facing or available to many user accounts. The main risk is unauthorized disruption or manipulation of customer address records.
Technical view
The issue is improper authorization/IDOR in TradeAddressController.java delete for the Trade Address Deletion Endpoint. PublicCMS versions 5.202506.a through 5.202506.d are listed as affected. CVSS v2 is 5.5 with network access, low complexity, authentication required, partial integrity impact, and partial availability impact.
Likely exposure
Exposure is most relevant for PublicCMS deployments using the trade module and reachable by authenticated users. Internet-facing portals with self-service accounts have higher practical risk than tightly restricted administrative systems.
Exploitation context
The source bundle states a public exploit exists, but CISA KEV is false and no provided source confirms active exploitation. The CVSS vector indicates an attacker needs authentication and can attack remotely with low complexity.
Researcher notes
Evidence comes primarily from VulDB and the CVE source bundle. The vendor reportedly did not respond, and no official fix is named in the provided sources. Avoid assuming broader PublicCMS impact beyond the listed trade address deletion endpoint and versions.
Mitigation direction
- Identify whether Sanluan PublicCMS 5.202506.a through 5.202506.d is in use.
- Review vendor or project guidance for a fixed version or official workaround.
- Restrict access to trade address functions to trusted authenticated users where possible.
- Monitor for unexpected address deletion or modification activity.
Validation and detection
- Confirm the deployed PublicCMS version against the affected version list.
- Determine whether the trade address deletion endpoint is enabled and reachable.
- Review authorization controls around trade address ownership and deletion.
- Check application logs for unusual or unauthorized address deletion events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1112 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR84.9Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
5.5MediumVector: AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-341704 | Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorizationCVE reference · vdb-entry, technical-description
- VDB-341704 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #732771 | publiccms PublicCMS <= V5.202506.d Insecure Direct Object Reference (IDOR)CVE reference · third-party-advisory
- https://github.com/AnalogyC0de/public_exp/issues/4CVE reference · exploit, issue-tracking
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.