CVE-2026-111658: Authorization Bypass Through User-Controlled Key in SiteServer SSCMS
Description
SiteServer SSCMS versions up to 7.4.0 have an authorization bypass vulnerability in the ChannelsController component. This flaw allows site-scoped administrators with Channels permission on one site to access and modify channels belonging to other sites by supplying foreign channel IDs. The vulnerability breaks multi-site isolation by enabling unauthorized reading and overwriting of channel names, file paths, templates, link URLs, and custom fields.
CVSS v4.0
Score 5.1medium
Affected software
SiteServer
SSCMS
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111658 is an authorization bypass vulnerability in SiteServer SSCMS through version 7.4.0. The issue exists in the ChannelsController, where site-scoped administrators can supply foreign channel IDs to access channels of other sites. This allows attackers with Channels permission on one site to read and overwrite channel-related data of other sites, violating multi-site isolation controls.
Potential Impact
An attacker with Channels permission on one site can bypass authorization controls to access and modify channel information of other sites within the same SSCMS instance. This compromises data integrity and confidentiality across multiple sites managed by the system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Channels permission to trusted administrators only and monitor for unauthorized access attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-16T14:31:15.965Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad264122cdf04f656199582
Added to database: 10/16/2026, 17:51:14 UTC
Last enriched: 10/16/2026, 18:34:05 UTC
Last updated: 10/16/2026, 19:03:25 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.