Description

A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of the component exportExcel/exportData. This manipulation of the argument userId/deptId causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-25T06:16:52.347Z",
  "pubdate": "2026-09-25T06:16:52.347Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in Sanluan PublicCMS up to version 6.202506.e, residing within the exportExcel and exportData functionalities. The flaw allows remote, unauthenticated, or unauthorized actors to manipulate parameters, specifically 'userId' and 'deptId', to gain access to sensitive administrative data exports.\nThis vulnerability stems from improper access control checks within the application's controller logic. By bypassing standard authorization mechanisms, an attacker can extract protected organizational data, which poses significant confidentiality risks. Given that public exploits are already available and the vendor has not responded to disclosure attempts, the risk of exploitation is elevated. Organizations utilizing affected versions are at high risk of unauthorized data exfiltration and potential exposure of sensitive user or department records.",
  "technicalDetails": "The vulnerability is located in the CmsContentAdminController, specifically within the file path: publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java. The flaw manifests due to a failure in the application to enforce strict session-based authorization checks when processing requests directed at the exportExcel and exportData endpoints.\nThe root cause is an improper validation of user input parameters, namely 'userId' and 'deptId', which are used to scope the data export functionality. The application logic assumes that the incoming request is intrinsically authorized, failing to cross-reference the requesting user's identity and privileges against the target parameters. Consequently, an attacker can supply arbitrary 'userId' or 'deptId' values to trigger the generation and retrieval of data exports that should otherwise be restricted to authorized administrators.\nThe attack flow proceeds as follows: An attacker identifies the target endpoint responsible for administrative data exports. By crafting an HTTP request—such as a GET or POST request targeting the export function—the attacker injects specific values into the 'userId' or 'deptId' parameters. Because the controller lacks robust server-side authorization checks for these parameters, the backend processes the request and executes the database query filtered by the attacker-supplied ID. The system then compiles the unauthorized data into an Excel file or export format and returns it to the attacker's client.\nThis vulnerability is remotely exploitable without requiring advanced privileges, as the system fails to verify that the request initiator has the requisite administrative permissions to access the requested scope. The impact is significant, as it enables the unauthorized exfiltration of structured data, potentially revealing sensitive information regarding system users or internal departmental structures. As the exploit is publicly accessible, the complexity of carrying out this attack is low, allowing even unsophisticated actors to compromise the confidentiality of the administrative data stores within PublicCMS environments. Post-exploitation, an attacker gains visibility into private system records, which could be used to facilitate further reconnaissance or escalate the impact of the initial breach."
}