This vulnerability affects Sanluan PublicCMS 5.202506.d in the Trade Address Query Handler component. The execute function in publiccms-trade/src/main/java/com/publiccms/views/directive/trade/TradeAddressListDirective.java improperly handles authentication when processing the userId/id argument. This flaw allows remote attackers to bypass authentication controls, potentially accessing or manipulating trade address data without proper authorization. The issue was disclosed publicly with exploit code available, but the vendor has not provided any fix or mitigation to date.

An attacker can remotely exploit this vulnerability to bypass authentication in the Trade Address Query Handler, potentially gaining unauthorized access to trade address information or related functionality. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, low complexity, and no required privileges or user interaction. There is no indication of further impact such as data integrity or availability loss beyond unauthorized access due to missing authentication.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Organizations using the affected version should consider implementing compensating controls such as restricting access to the vulnerable component via network controls or application-layer protections until a fix is released. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.