SiteServer SSCMS EUVD-2026-103080

Requires an authenticated SSCMS administrator account that is site-scoped and holds the Channels permission on at least one site, plus a deployment running in multi-site/multi-tenant mode (the only configuration where foreign channel IDs exist to target). Exploitation is performed against the ChannelsController Get and Update admin APIs by supplying another site's channel ID. Limiting factors: privileged account access is mandatory (PR:H), so this is primarily an insider or compromised-tenant-admin threat; single-site installations have no cross-site channels to abuse and are effectively unaffected; impact is bounded to channel metadata (names, file paths, templates, link URLs, custom fields) with no availability impact.

This is a genuine but moderate-risk multi-tenant authorization flaw (CWE-639, IDOR), not a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N, score 5.1) is internally consistent with the description: it requires an already-privileged, authenticated site-scoped administrator (PR:H), works remotely over the network with low complexity and no user interaction, and yields only low confidentiality and low integrity impact with no availability impact. No EPSS score, no CISA KEV entry, and no explicitly flagged public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - though a detailed third-party technical writeup exists on hackmd that could materially lower the barrier to reproduction. The signals are mutually reinforcing rather than conflicting: the low CVSS, the privilege prerequisite (a trusted delegated admin), and the absence of KEV/POC all point to a lower-urgency, insider-or-compromised-tenant threat rather than mass internet exploitation. The main caveat is that risk is entirely conditional on running a genuine multi-site/multi-tenant SSCMS deployment; in single-site installs there is effectively no exposure.

A legitimate (or attacker-controlled) administrator scoped to Site A with Channels permission logs into the SSCMS admin panel and calls the ChannelsController Get/Update APIs while substituting a channel ID belonging to Site B. Because the controller trusts the user-supplied channel ID without verifying it belongs to the caller's site, the attacker reads and overwrites Site B's channel names, file paths, templates, link URLs, and custom fields. A public technical writeup describing the cross-site IDOR exists, but no packaged exploit was flagged in the provided data.