CVE-2026-111658 Details

A cross-site authorization bypass vulnerability has been identified in SiteServer SSCMS versions through 7.4.0. This vulnerability resides in the ChannelsController of the admin channel API. It allows site-scoped administrators to access and manipulate channels belonging to other sites by using foreign channel IDs. Specifically, administrators with Channels permission on one site can read and overwrite another site's channel details, including names, file paths, templates, link URLs, and custom fields. This issue disrupts the intended multi-site isolation.

After loading a channel by ID in any admin channel action, verify that the channel's SiteId matches the request's SiteId. If it does not, return a 'not found' or 'unauthorized' response. Additionally, replace the single-channel ID lookups with a site-scoped accessor that filters by both SiteId and channel ID, and update the channel repository's write methods to include site ID checks.