Authorization Bypass in SiteServer SSCMS Affects Multi-Site Channels Access

CVE-2026-111658

What is CVE-2026-111658?

An authorization bypass vulnerability exists in the ChannelsController of SiteServer SSCMS versions up to 7.4.0. This flaw allows site-scoped administrators to access channels from other sites by manipulating foreign channel IDs. Attackers who possess Channels permissions on one site can potentially read and alter another site’s channel data, including names, file paths, templates, link URLs, and custom fields. This vulnerability undermines multi-site isolation, making it imperative for users to implement security measures to mitigate potential risks.

References