Threats affecting pkg:github/riyuedeqi/jizhicms-order-idor

CVE-2026-116274 is an improper authorization vulnerability in JIZHICMS versions 2.5.0 through 2.5.6. It affects the Pay function in the app/home/c/OrderController.php file, allowing remote attackers to manipulate the orderno argument to bypass authorization controls. The vulnerability has been publicly disclosed with available exploit details, but the vendor has not responded or issued a patch.