CVE-2026-97721

Name of the Vulnerable Software and Affected Versions Sanluan PublicCMS versions prior to 6.202506.e

Description An authorization bypass exists in the exportExcel/exportData component. The issue resides within the CmsContentAdminController() function located in the publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java file. A remote attacker can trigger this by manipulating the userId or deptId arguments.

Recommendations As a temporary workaround, restrict access to the exportExcel/exportData component or avoid using the userId and deptId arguments in the affected function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.