CVE-2026-111658
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
Risk Assessment
Breach of multi-site isolation — an administrator of one site can modify content and configuration of other sites. This may lead to defacement, data leakage, or privilege escalation.
Recommendation
Upgrade SiteServer SSCMS to a version newer than 7.4.0. Until then, consider minimizing Channels permissions.
Other vulnerabilities in SiteServer SSCMS
Original NVD description (English source)
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS