CVE-2026-111658: SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated site-scoped administrator who has Channels permission on at least one site can exploit it. No user interaction is required.
What access can an attacker gain across sites?
The attacker can access channels belonging to other sites by supplying channel IDs from those sites. They can read and overwrite channel names, file paths, templates, link URLs, and custom fields.
Are installations through version 7.4.0 affected?
Yes. The affected range is SiteServer SSCMS through version 7.4.0.
How can I determine whether my deployment is exposed?
Determine whether the deployment runs SiteServer SSCMS 7.4.0 or earlier and whether site-scoped administrators are granted Channels permission. Affected users may be able to retrieve or update a channel after replacing its channel ID with an ID belonging to another site.