---
id: "CVE-2026-111658"
kind: "vulnerability"
aliases: ["CVE-2026-111658"]
title: "SiteServer SSCMS: site admins can read and overwrite other sites' channels"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "multi-site", "package", "siteserver", "sscms"]
not_affected_if: ["all-admins-trusted", "single-site"]
published_at: "2026-10-16T18:17:47+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:29:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111658", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# SiteServer SSCMS: site admins can read and overwrite other sites' channels

SiteServer SSCMS through 7.4.0 has an authorization bypass in its ChannelsController: a site-scoped administrator who supplies foreign channel IDs can read and modify channels belonging to other sites. An attacker can change channel names, file paths, templates, link URLs and custom fields, which breaks isolation between sites.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SSCMS version; `unknown` for the exact build command, the sources do not give one
- Review which accounts hold site-scoped Channels permission on more than one site

## Fix

- Move SiteServer SSCMS past `7.4.0`; the sources do not name the fixed version
- Until patched, limit Channels permission to trusted administrators

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111658

## From the sources

SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_