Low severity · published Oct 16, 2026
CVE-2026-111658
SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API
3.8
CVSS
0.3%
EPSS
No
On KEV
Description
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SSCMS · SiteServer
through 7.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111658
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111658
github.com
https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Get.cs#L16-L41
github.com
https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Update.cs#L14-L31
hackmd.io
https://hackmd.io/@hieuPenguinnn/sscms-cross-site-channel-idor
www.vulncheck.com
https://www.vulncheck.com/advisories/siteserver-sscms-through-7.4.0-cross-site-authorization-bypass-via-channels-api
More from SSCMS
7.2
CVE-2026-7435
SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString
4.6
CVE-2026-7429
SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing