CVE-2026-111658: fallo de gravedad media en SiteServer SSCMS
SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.3%
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
SiteServer · SSCMSCVEs relacionadas — SiteServer SSCMS
En el mismo producto, de las más peligrosas a las menos.
Referencias
https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Get.cs#L16-L41https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Update.cs#L14-L31https://hackmd.io/@hieuPenguinnn/sscms-cross-site-channel-idorhttps://www.vulncheck.com/advisories/siteserver-sscms-through-7.4.0-cross-site-authorization-bypass-via-channels-api