{"id":"CVE-2026-111658","kind":"vulnerability","aliases":["CVE-2026-111658"],"related":[],"title":"SiteServer SSCMS: site admins can read and overwrite other sites' channels","description":"SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.","summary":"SiteServer SSCMS through 7.4.0 has an authorization bypass in its ChannelsController: a site-scoped administrator who supplies foreign channel IDs can read and modify channels belonging to other sites. An attacker can change channel names, file paths, templates, link URLs and custom fields, which breaks isolation between sites.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","multi-site","package","siteserver","sscms"],"not_affected_if":["all-admins-trusted","single-site"],"how_to_check":"- Check the installed SSCMS version; `unknown` for the exact build command, the sources do not give one\n- Review which accounts hold site-scoped Channels permission on more than one site","fix":"- Move SiteServer SSCMS past `7.4.0`; the sources do not name the fixed version\n- Until patched, limit Channels permission to trusted administrators","status":"open","published_at":"2026-10-16T18:17:47+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:29:14+00:00","updated_at":"2026-10-25T04:29:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:29:14Z","model":"claude-haiku-5-5","output":{"fix":"- Move SiteServer SSCMS past `7.4.0`; the sources do not name the fixed version\n- Until patched, limit Channels permission to trusted administrators","reach":"network","title":"SiteServer SSCMS: site admins can read and overwrite other sites' channels","impact":"medium","summary":"SiteServer SSCMS through 7.4.0 has an authorization bypass in its ChannelsController: a site-scoped administrator who supplies foreign channel IDs can read and modify channels belonging to other sites. An attacker can change channel names, file paths, templates, link URLs and custom fields, which breaks isolation between sites.","category":"package","nicknames":[],"who_cares":["sscms","siteserver","cms","multi-site"],"confidence":0.7,"needs_auth":"yes","worst_case":"Other sites' channels are read and overwritten by a site admin","analyst_note":"Confirm the fixed SSCMS version and whether the sources list a patched release, from the NVD entry linked above.","how_to_check":"- Check the installed SSCMS version; `unknown` for the exact build command, the sources do not give one\n- Review which accounts hold site-scoped Channels permission on more than one site","needs_analyst":true,"not_affected_if":["single-site","all-admins-trusted"],"who_is_affected":"Installations of SiteServer SSCMS up to and including 7.4.0 that host several sites with site-scoped administrators. A single-site installation, or one where every administrator is fully trusted across all sites, has less exposure to the cross-site part of this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000623,"input_tokens":3350,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111658':14A,17A '-2026':13A,16A '7.4.0':28B,77C 'access':92C 'admin':4A 'administr':40B,90C 'allow':86C 'anoth':112C 'attack':56B,101C 'author':31B,80C 'belong':51B 'break':70B,125C 'bypass':32B,81C 'chang':58B 'channel':11A,44B,50B,59B,95C,99C,103C,115C 'channelscontrol':35B,84C 'cms':18B 'contain':78C 'custom':67B,123C 'cve':12A,15A 'field':68B,124C 'file':61B,117C 'foreign':43B,98C 'id':45B,100C 'isol':71B,129C 'link':64B,120C 'modifi':49B 'multi':20B,127C 'multi-sit':19B,126C 'name':60B,116C 'one':106C 'overwrit':8A,111C 'packag':22B 'path':62B,118C 'permiss':104C 'read':6A,47B,109C 'scope':39B,89C 'site':3A,10A,21B,38B,54B,73B,88C,94C,107C,113C,128C 'site-scop':37B,87C 'siteserv':1A,23B,25B,74C 'sscms':2A,24B,26B,75C 'suppli':42B,97C 'templat':63B,119C 'url':65B,121C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Installations of SiteServer SSCMS up to and including 7.4.0 that host several sites with site-scoped administrators. A single-site installation, or one where every administrator is fully trusted across all sites, has less exposure to the cross-site part of this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111658","severity":null,"published_at":"2026-10-16T18:17:47+00:00","modified_at":"2026-10-23T16:16:50+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}