{"id":"CVE-2026-126993","kind":"vulnerability","aliases":["CVE-2026-126993"],"related":[],"title":"SiteServer SSCMS: captcha endpoint uses weak encryption on its Value argument","description":"A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"SiteServer SSCMS up to 7.2.2 has a flaw in the /api/v1/captcha endpoint where the Value argument is protected with inadequate encryption strength. A remote attacker can exploit it, and a public exploit has been released.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","siteserver","sscms"],"not_affected_if":["sscms-above-7.2.2"],"how_to_check":"- Check the installed SSCMS version and see whether it is `7.2.2` or earlier.\n- Look for the `/api/v1/captcha` route in your deployment.","fix":null,"status":"open","published_at":"2026-11-12T13:17:15+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","triaged_at":"2026-11-12T13:38:55+00:00","updated_at":"2026-11-12T13:38:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T13:38:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SiteServer SSCMS: captcha endpoint uses weak encryption on its Value argument","impact":"low","summary":"SiteServer SSCMS up to 7.2.2 has a flaw in the /api/v1/captcha endpoint where the Value argument is protected with inadequate encryption strength. A remote attacker can exploit it, and a public exploit has been released.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sscms","siteserver","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"captcha protection on Value can be weakened remotely","analyst_note":"Check NVD and the vendor or project repo for a fixed version and whether authentication is needed; the vendor did not respond to disclosure.","how_to_check":"- Check the installed SSCMS version and see whether it is `7.2.2` or earlier.\n- Look for the `/api/v1/captcha` route in your deployment.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["sscms-above-7.2.2"],"who_is_affected":"Teams that run SiteServer SSCMS 7.2.2 or earlier with the captcha API reachable over the network are exposed. The sources do not say which configurations are affected, so treat any reachable instance as in scope until the vendor responds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4582,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126993':14A,17A '-2026':13A,16A '/api/v1/captcha':34B,79C '7.2.2':28B,70C 'argument':11A,39B,85C 'attack':48B,93C,114C 'captcha':3A 'carri':98C 'contact':118C 'cve':12A,15A 'disclosur':122C 'discov':64C 'earli':119C 'encrypt':7A,44B,90C 'endpoint':4A,35B 'exploit':50B,55B,102C 'file':78C 'flaw':31B,61C 'function':75C 'host':21B 'impact':71C 'inadequ':43B,89C 'manipul':82C 'may':110C 'packag':18B 'perform':80C 'possibl':95C 'protect':41B 'public':54B,108C 'releas':58B,105C 'remot':47B,100C 'respond':126C 'result':87C 'secur':60C 'self':20B 'self-host':19B 'siteserv':1A,22B,24B,66C 'sscms':2A,23B,25B,67C 'strength':45B,91C 'unknown':74C 'use':5A,112C 'valu':10A,38B,86C 'vendor':116C 'way':129C 'weak':6A","nicknames":[],"mitigations":[],"who_affected":"Teams that run SiteServer SSCMS 7.2.2 or earlier with the captcha API reachable over the network are exposed. The sources do not say which configurations are affected, so treat any reachable instance as in scope until the vendor responds.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","siteserver","sscms"],"campaign_type":null,"search_a":"'-126993':14A,17A '-2026':13A,16A 'argument':11A 'captcha':3A 'cve':12A,15A 'encrypt':7A 'endpoint':4A 'siteserv':1A 'sscms':2A 'use':5A 'valu':10A 'weak':6A","search_b":"'/api/v1/captcha':34B '7.2.2':28B 'argument':39B 'attack':48B 'encrypt':44B 'endpoint':35B 'exploit':50B,55B 'flaw':31B 'host':21B 'inadequ':43B 'packag':18B 'protect':41B 'public':54B 'releas':58B 'remot':47B 'self':20B 'self-host':19B 'siteserv':22B,24B 'sscms':23B,25B 'strength':45B 'valu':38B","search_c":"'/api/v1/captcha':79C '7.2.2':70C 'argument':85C 'attack':93C,114C 'carri':98C 'contact':118C 'disclosur':122C 'discov':64C 'earli':119C 'encrypt':90C 'exploit':102C 'file':78C 'flaw':61C 'function':75C 'impact':71C 'inadequ':89C 'manipul':82C 'may':110C 'perform':80C 'possibl':95C 'public':108C 'releas':105C 'remot':100C 'respond':126C 'result':87C 'secur':60C 'siteserv':66C 'sscms':67C 'strength':91C 'unknown':74C 'use':112C 'valu':86C 'vendor':116C 'way':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126993","severity":null,"published_at":"2026-11-12T13:17:15+00:00","modified_at":"2026-11-12T13:17:15+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","fetched_at":"2026-11-12T13:38:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}