CVE-2026-111658
Received Received - Intake

Authorization Bypass in SiteServer SSCMS

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111658
EUVD
EUVD-2026-103080

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SiteServer SSCMS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiteServer SSCMS through version 7.4.0 has an authorization bypass flaw in the ChannelsController. Site-scoped administrators can access other sites' channels by providing foreign channel IDs. This allows attackers with Channels permission on one site to read or modify another site's channel details, including names, file paths, templates, and custom fields, breaking the isolation between multiple sites.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data across different sites. Attackers might read or alter channel configurations, leading to data leaks, website defacement, or disruption of services. Organizations using multi-site setups with SiteServer SSCMS could face compromised site integrity and confidentiality.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to protected data. GDPR requires strict data access controls, while HIPAA mandates safeguards for sensitive health information. Exploitation may result in data breaches, triggering legal penalties and reputational damage.

Mitigation Strategies

Immediately update SiteServer SSCMS to the latest version beyond 7.4.0 to patch the authorization bypass in ChannelsController. Restrict Channels permissions to only necessary site administrators and audit existing permissions to ensure no unauthorized access is possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111658. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart