CVE-2026-97721
Received Received - Intake

Authorization Bypass in Sanluan PublicCMS

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulDB

Description
A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of the component exportExcel/exportData. This manipulation of the argument userId/deptId causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97721
EUVD
EUVD-2026-86525

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sanluan publiccms to 6.202506.e (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a missing authorization vulnerability in PublicCMS affecting the endpoints GET /admin/cmsContent/exportExcel and GET /admin/cmsContent/exportData. An authenticated backend administrator can exploit it to export site content outside their intended user or department scope, including content owned by another administrator. The issue arises from improper validation of the SysUser.contentPermissions property, allowing an attacker to set an invalid value that bypasses content export scoping.

The root causes include missing server-side authorization checks and lack of object-scope validation. The exploit manipulates the userId or deptId argument to bypass authorization.

Detection Guidance

Check for unauthorized access to endpoints GET /admin/cmsContent/exportExcel and GET /admin/cmsContent/exportData. Monitor logs for HTTP GET requests to these paths with unusual parameters like userId or deptId set to invalid values (e.g., 7). Verify if responses include content outside the expected user or department scope.

Impact Analysis

An attacker with backend administrator access could export sensitive site content beyond their authorized scope. This includes data owned by other administrators, leading to unauthorized bulk disclosure of information within the site. The impact is read-only but could expose confidential or proprietary data.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update PublicCMS to the latest version if available. Implement server-side authorization checks for the exportExcel and exportData endpoints. Validate the SysUser.contentPermissions property against an allowlist before processing requests. Reject out-of-scope identifiers before database operations and ensure unauthorized callers receive HTTP 403 responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97721. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart