# CVE-2026-8737: Sanluan PublicCMS missing authentication in Trade Address Query Handler

Source: https://junglewise.ai/threats/cve-2026-8737-sanluan-publiccms-missing-authentication-in-trade-address-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2026-8737 · Severity: medium · CVSS 5.3 · Published 2026-05-17

Sanluan PublicCMS, a content management system, contains a security flaw in its trade module that handles shipping addresses. An unauthenticated attacker can remotely access the system to view sensitive customer information, including full names, shipping addresses, and phone numbers. This could lead to large-scale data theft and privacy violations for users of the platform.

Technologies: [Sanluan PublicCMS](https://junglewise.ai/threats/technologies/publiccms). Vendors: [Sanluan](https://junglewise.ai/threats/vendors/sanluan).

## Quick answers

**Is CVE-2026-8737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8737 being exploited in the wild.

**How severe is CVE-2026-8737?** Medium severity, with a CVSS score of 5.3, published 17 May 2026.

**Which products and versions are affected?** Sanluan PublicCMS 5.202506.d.

**Is there a fix for CVE-2026-8737?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8737 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-8737?** Check whether you run Sanluan PublicCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authentication vulnerability exists in the TradeAddressListDirective and TradeAddressDirective components of Sanluan PublicCMS. The affected directives inherit from AbstractTemplateDirective but fail to override the needAppToken() or needUserToken() methods, leaving the /api/directive/trade/addressList and /api/directive/trade/address endpoints accessible to unauthenticated users. By manipulating the 'userId' or 'id' parameters in a GET request, a remote attacker can bypass authorization checks to retrieve TradeAddress entity data. This data includes sensitive fields such as the addressee name, physical address, and telephone number. A public exploit is available, and the vendor has reportedly not responded to disclosure attempts.

## Affected products

- Sanluan PublicCMS 5.202506.d

## Timeline

- 2026-05-17: advisory: Vulnerability disclosed via VulDB and NVD

## References

- [https://vuldb.com/submit/809885](https://vuldb.com/submit/809885)
- [https://vuldb.com/vuln/364325](https://vuldb.com/vuln/364325)
- [https://vuldb.com/vuln/364325/cti](https://vuldb.com/vuln/364325/cti)
- [https://vulnplus-note.wetolink.com/share/VqmGhijVKGBM](https://vulnplus-note.wetolink.com/share/VqmGhijVKGBM)

## Related threats

- [Sanluan PublicCMS authorization bypass in trade payment](https://junglewise.ai/threats/cve-2026-121583-a-vulnerability-was-identified-in-sanluan-publiccms-5-this)
- [Sanluan PublicCMS authorization bypass in TradeRefundService](https://junglewise.ai/threats/cve-2026-120319-a-vulnerability-was-found-in-sanluan-publiccms-4-x-5-x-6-x-this)
- [PublicCMS insecure direct object reference in TradeAddressController](https://junglewise.ai/threats/cve-2026-110113-publiccms-through-v6-202608-a-contains-an-insecure-direct-object)
- [Sanluan PublicCMS SSTI and auth bypass in templateResult API](https://junglewise.ai/threats/cve-2026-8740-sanluan-publiccms-ssti-and-auth-bypass-in-templateresult-api)
- [Sanluan PublicCMS hard-coded cryptographic key in private file access](https://junglewise.ai/threats/cve-2026-8739-sanluan-publiccms-hard-coded-cryptographic-key-in-private-file)