SiteServer SSCMS versions up to 7.4.0 contain an authorization bypass flaw within the ChannelsController that allows site‑specific administrators to request channel information or modify channel data belonging to other sites in a multi‑site deployment. By supplying a foreign channel identifier, an attacker with mere Channels permission on one site can read and update channel names, file paths, templates, link URLs, and custom fields on unrelated sites, violating the isolation boundary. This weakness is categorized as CWE‑639, representing improper authorization decisions.

The affected product is SiteServer SSCMS, with all releases up to and including version 7.4.0. Administrators or users granted the Channels permission within any single site may exploit the issue to affect other sites hosted by the same instance. No specific vendor or product version prefixes are listed beyond "SSCMS:SSCMS," and the CPE entry confirms coverage of the entire product family.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not reported, and the vulnerability is not listed in CISA’s KEV catalog, suggesting there is currently no evidence of widespread exploitation. However, an attacker only needs partial access (Channels privilege) on one site, a permissive role that is often granted to site administrators, thus the practical exploitability remains significant in a multi‑site environment.