CVE-2026-95653: Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Concrete CMS Community Store before version 2.7.8 that sell digital products are exposed. Customers who purchased downloadable goods may have those goods retrieved by an unauthenticated third party.
What does an attacker need to exploit it?
The attacker does not need an account or user interaction. They can enumerate sequential order and file identifiers and calculate tokens because the tokens are derived from order creation timestamps rather than random values.
Are default deployments affected?
The provided information identifies affected versions before 2.7.8 and does not describe any configuration prerequisite or mitigation. Any such deployment offering digital downloads should be treated as affected.
How can I tell whether my site is vulnerable?
Check the installed Community Store version. Versions before 2.7.8 are affected; version 2.7.7 contains the referenced download-token implementation.