CVE-2026-8738: Publiccms Trade Payment Idor Missing Session User

Trade order controller method accepts an orderId from the HTTP request, loads the TradeOrder by that attacker-supplied numeric id, and acts on it (initiate payment, debit balance, cancel, refund) without binding @SessionAttribute SysUser to verify that the authenticated caller actually owns the referenced order. Only the siteId is validated, so any authentic

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0Java
greprules fetch cve-2026-8738-publiccms-trade-payment-idor-missing-session-user --engine opengrep

Description

Trade order controller method accepts an orderId from the HTTP request, loads the TradeOrder by that attacker-supplied numeric id, and acts on it (initiate payment, debit balance, cancel, refund) without binding @SessionAttribute SysUser to verify that the authenticated caller actually owns the referenced order. Only the siteId is validated, so any authentic