Vulnerability · Published Sep 22, 2026 · Assigned by VulnCheck
CVE-2026-95653Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
High 7.5
In plain English
A high-severity security flaw in community_store from concretecms-community-store. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| concretecms-community-store | community_store | 0 – before 2.7.8 |
Weakness: CWE-340 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- Patch Commit patch
- https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L17 technical-description
- https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L45 technical-description
- community_store v2.7.8 Release Notes release-notes
- https://github.com/concretecms-community-store/community_store product
- VulnCheck Advisory: Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token third-party-advisory