CVE-2026-111658

SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.

CVSS 4.0

5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

3.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2026-10-16

Modified

2026-10-23

Record from

the NVD, synced 2026-10-23

References

• https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Get.cs#L16-L41
• https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Update.cs#L14-L31
• https://hackmd.io/@hieuPenguinnn/sscms-cross-site-channel-idor
• https://www.vulncheck.com/advisories/siteserver-sscms-through-7.4.0-cross-site-authorization-bypass-via-channels-api
• https://hackmd.io/@hieuPenguinnn/sscms-cross-site-channel-idor

Check your stackJSON