Live › vulnerability › CVE-2026-111658
Go to dashboardSiteServer SSCMS through 7.4.0 has an authorization bypass in its ChannelsController: a site-scoped administrator who supplies foreign channel IDs can read and modify channels belonging to other sites. An attacker can change channel names, file paths, templates, link URLs and custom fields, which breaks isolation between sites.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations of SiteServer SSCMS up to and including 7.4.0 that host several sites with site-scoped administrators. A single-site installation, or one where every administrator is fully trusted across all sites, has less exposure to the cross-site part of this flaw.
No product ranges from the sources yet.
unknown for the exact build command, the sources do not give one7.4.0; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
This page as .md · .json · in your agent: get_signal("CVE-2026-111658")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.