Community Store CVE-2026-95653

Applies to Concrete CMS Community Store before 2.7.8 with digital/downloadable products enabled (the download-token feature in Utilities/Download.php). Exploitation is remote and unauthenticated (PR:N/UI:N) against default configurations wherever digital goods are sold. The practical limiting factor is that the token is md5 of the order's creation timestamp at one-second resolution, so the attacker must know or brute-force the exact second an order was created, and must enumerate valid order/file ID pairs; legacy orders created before patching remain exploitable via the md5 fallback path until superseded.

This is a genuine, high-priority confidentiality flaw despite the absence of exploitation telemetry. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores 8.7 and is consistent with the description: an unauthenticated network attacker enumerates sequential order and file IDs and computes the download token, which the code (confirmed in source at Download.php) derives as md5(order creation timestamp 'Y-m-d H:i:s') rather than a random value - CWE-340 (predictability of a security token). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is not confirmed as actively exploited; the appropriate status is 'no public exploit identified at time of analysis.' The one signal that partially tempers AC:L is that the token is the md5 of the order timestamp to one-second precision, so an attacker must know or brute-force the exact creation second of a victim order - practical when order times are inferable (e.g. from receipts, RSS, or narrow windows) but not entirely free, which is worth verifying against the vendor advisory. Impact is strictly confidentiality (VI:N/VA:N): retrieval of digital goods purchased by other customers, with no integrity or availability effect. The patch is confirmed available (v2.7.8 / commit a71138d adds a random 32-char getString security code and validates against it, with an md5 fallback for legacy orders). Net: a real, easy-to-understand data-exposure bug in a patched release - prioritize patching for anyone running Community Store, but it is a targeted data-theft risk rather than mass-exploitation infrastructure.

An unauthenticated attacker browses a Concrete CMS store selling digital downloads, notes that download URLs follow /store_download/{fileID}/{orderID}/{md5(order timestamp)}, then iterates sequential order and file IDs while computing candidate md5 tokens from guessed order-creation seconds. On a match, the server serves another customer's purchased digital file. No public POC is referenced, but the VulnCheck advisory documents the predictable-token mechanism and the vulnerable source lines make reconstruction straightforward.