{"id":"CVE-2026-124575","kind":"vulnerability","aliases":["CVE-2026-124575"],"related":[],"title":"SiteServer SSCMS: admin login CAPTCHA bypass allows excessive login attempts","description":"A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.","summary":"SiteServer SSCMS, a content management system, fails to restrict repeated admin login attempts when the isForceLogoutAndLogin argument is manipulated. An attacker can make many authentication attempts against the admin login, which the CAPTCHA was meant to limit.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","other","self-hosted","siteserver-sscms"],"not_affected_if":["admin-not-internet-exposed"],"how_to_check":"- Check the installed SSCMS version against the affected range up to 7.1.3, 7.2.1 and 7.4.0\n- Look at src/SSCMS.Web/Controllers/Admin/LoginController.cs for the Submit method handling isForceLogoutAndLogin","fix":"- A patch exists, referenced as commit df3becb7ebb00a48435418a44fd08a459eb38ace; the fixed version is unknown from the sources","status":"open","published_at":"2026-11-09T07:17:32+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","triaged_at":"2026-11-09T07:25:24+00:00","updated_at":"2026-11-09T07:25:24+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T07:25:24Z","model":"claude-haiku-5-5","output":{"fix":"- A patch exists, referenced as commit df3becb7ebb00a48435418a44fd08a459eb38ace; the fixed version is unknown from the sources","reach":"internet","title":"SiteServer SSCMS: admin login CAPTCHA bypass allows excessive login attempts","impact":"low","summary":"SiteServer SSCMS, a content management system, fails to restrict repeated admin login attempts when the isForceLogoutAndLogin argument is manipulated. An attacker can make many authentication attempts against the admin login, which the CAPTCHA was meant to limit.","audience":"businesses","category":"other","nicknames":[],"who_cares":["siteserver-sscms","self-hosted","cms"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unlimited password guessing against admin logins","analyst_note":"","how_to_check":"- Check the installed SSCMS version against the affected range up to 7.1.3, 7.2.1 and 7.4.0\n- Look at src/SSCMS.Web/Controllers/Admin/LoginController.cs for the Submit method handling isForceLogoutAndLogin","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["admin-not-internet-exposed"],"who_is_affected":"Teams that run SiteServer SSCMS with its admin panel reachable from the internet are exposed. Installations where the admin login is restricted to a private network or behind a VPN are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4706,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124575':13A,16A '-2026':12A,15A '/7.2.1/7.4.0':72C '7.1.3':71C 'admin':3A,35B,53B,87C 'admin-login':86C 'advis':138C 'affect':75C 'allow':7A 'appli':134C 'argument':41B,94C 'assess':124C 'associ':117C 'attack':45B,110C,120C 'attempt':10A,37B,50B,103C 'authent':49B,102C 'bypass':6A 'captcha':5A,57B,89C 'cms':17B 'complex':114C 'compon':85C 'content':28B 'cve':11A,14A 'df3becb7ebb00a48435418a44fd08a459eb38ace':133C 'difficult':126C 'excess':8A,101C 'exploit':122C 'fail':31B 'file':81C 'function':77C 'high':113C 'host':21B 'identifi':65C 'improp':98C 'isforcelogoutandlogin':40B,95C 'issu':74C,142C 'launch':108C 'lead':96C 'level':115C 'limit':61B 'login':4A,9A,36B,54B,88C 'logincontroller.submit':78C 'make':47B 'manag':29B 'mani':48B 'manipul':43B,91C 'meant':59B 'name':128C 'patch':131C,136C 'possibl':106C 'remot':111C 'repeat':34B 'resolv':140C 'restrict':33B,99C 'self':20B 'self-host':19B 'siteserv':1A,23B,25B,67C 'siteserver-sscm':22B 'src/sscms.web/controllers/admin/logincontroller.submit.cs':82C 'sscms':2A,24B,26B,68C 'system':30B 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Teams that run SiteServer SSCMS with its admin panel reachable from the internet are exposed. Installations where the admin login is restricted to a private network or behind a VPN are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","medium","other","selfhosted","siteserversscms"],"campaign_type":null,"search_a":"'-124575':13A,16A '-2026':12A,15A 'admin':3A 'allow':7A 'attempt':10A 'bypass':6A 'captcha':5A 'cve':11A,14A 'excess':8A 'login':4A,9A 'siteserv':1A 'sscms':2A","search_b":"'admin':35B,53B 'argument':41B 'attack':45B 'attempt':37B,50B 'authent':49B 'captcha':57B 'cms':17B 'content':28B 'fail':31B 'host':21B 'isforcelogoutandlogin':40B 'limit':61B 'login':36B,54B 'make':47B 'manag':29B 'mani':48B 'manipul':43B 'meant':59B 'repeat':34B 'restrict':33B 'self':20B 'self-host':19B 'siteserv':23B,25B 'siteserver-sscm':22B 'sscms':24B,26B 'system':30B","search_c":"'/7.2.1/7.4.0':72C '7.1.3':71C 'admin':87C 'admin-login':86C 'advis':138C 'affect':75C 'appli':134C 'argument':94C 'assess':124C 'associ':117C 'attack':110C,120C 'attempt':103C 'authent':102C 'captcha':89C 'complex':114C 'compon':85C 'df3becb7ebb00a48435418a44fd08a459eb38ace':133C 'difficult':126C 'excess':101C 'exploit':122C 'file':81C 'function':77C 'high':113C 'identifi':65C 'improp':98C 'isforcelogoutandlogin':95C 'issu':74C,142C 'launch':108C 'lead':96C 'level':115C 'login':88C 'logincontroller.submit':78C 'manipul':91C 'name':128C 'patch':131C,136C 'possibl':106C 'remot':111C 'resolv':140C 'restrict':99C 'siteserv':67C 'src/sscms.web/controllers/admin/logincontroller.submit.cs':82C 'sscms':68C 'vulner':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124575","severity":null,"published_at":"2026-11-09T07:17:32+00:00","modified_at":"2026-11-09T07:17:32+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","fetched_at":"2026-11-09T07:25:05+00:00","note":null}],"documents":[{"id":106286,"url":"https://github.com/siteserver/cms/commit/df3becb7ebb00a48435418a44fd08a459eb38ace","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}