Concrete CMS Community Store generates digital download tokens from the order creation timestamp instead of a random value; this predictable token scheme allows attackers to compute valid download URLs for purchased products. As a result, unauthenticated users can bypass access controls and retrieve digital goods bought by other customers, directly compromising confidentiality. The underlying weakness is classified as CWE-340.

The vulnerability affects all installations of the Concrete CMS Community Store component running any version prior to v2.7.8. Users of community_store 2.7.7 or earlier that provide digital downloads are susceptible, regardless of server environment or configuration.

The vulnerability has a CVSS score of 8.7, indicating high severity. No EPSS score or KEV listing is available, but the description shows that authentication is not required and the token calculations are deterministic once an attacker knows the order and file identifiers. The risk to sites with active digital downloads is therefore moderate to high, as attackers can enumerate sequential order and file IDs to forge valid tokens.