CVE-2026-111658: falha de média gravidade em SiteServer SSCMS
SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.3%
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
SiteServer · SSCMSCVEs relacionadas — SiteServer SSCMS
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Get.cs#L16-L41https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Update.cs#L14-L31https://hackmd.io/@hieuPenguinnn/sscms-cross-site-channel-idorhttps://www.vulncheck.com/advisories/siteserver-sscms-through-7.4.0-cross-site-authorization-bypass-via-channels-api