Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111658SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API

Low 3.8

In plain English

A low-severity authorization bypass via user-controlled key in SSCMS from SiteServer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.3%top 74.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.

Affected products (as reported)

Vendor	Product	Versions
SiteServer	SSCMS	0 – through 7.4.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

https://hackmd.io/@hieuPenguinnn/sscms-cross-site-channel-idor third-party-advisory
https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Update.cs#L14-L31 technical-description
https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Get.cs#L16-L41 technical-description
VulnCheck Advisory: SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API third-party-advisory