CVE-2026-95653
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.
Risk Assessment
An unauthenticated attacker can download digital products belonging to other customers, leading to content theft and loss of customer trust. This may result in financial and reputational damage.
Recommendation
Update Concrete CMS Community Store to version 2.7.8 or later. Until then, consider disabling digital product sales or monitoring for unusual downloads.
Other vulnerabilities in Concrete CMS Community Store
Original NVD description (English source)
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS