CVE-2026-111658Published
SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111658 · Microsoft / collected KEV context
cve-program · CVE-2026-111658
- https://hackmd.io/@hieuPenguinnn/sscms-cross-site-channel-idor
- https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Update.cs#L14-L31
- https://github.com/siteserver/cms/blob/sscms-v7.2.1/src/SSCMS.Web/Controllers/Admin/Cms/Channels/ChannelsController.Get.cs#L16-L41
- https://www.vulncheck.com/advisories/siteserver-sscms-through-7.4.0-cross-site-authorization-bypass-via-channels-api
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.