Authorization Bypass Vulnerability in Sanluan PublicCMS
CVE-2026-97721

5.1MEDIUM

Key Information:

Vendor: Sanluan
Status: Publiccms
Vendor: CVE Published:; 25 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-97721?

A significant vulnerability exists in Sanluan PublicCMS, affecting versions up to 6.202506.e. This flaw is found in the CmsContentAdminController, specifically in the exportExcel/exportData functionality. An attacker can exploit this vulnerability to bypass authorization controls by manipulating the userId and deptId arguments. This exploitation can occur remotely, making systems utilizing this CMS particularly vulnerable. Publicly available exploit details have raised concerns, as the vendor has not responded to early disclosures regarding this critical issue.

Affected Version(s)

PublicCMS 6.202506.a

PublicCMS 6.202506.b

PublicCMS 6.202506.c

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-97721 - Proof of Concept