CVE-2026-95653 (CVSS 7.5)

Description

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.

Is your site exposed to CVE-2026-95653?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploit Prediction

0.0057

Probability of exploitation

0.45%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-340 CWE-340

References

Other References

https://github.com/concretecms-community-store/community_store https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L17 https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L45 https://github.com/concretecms-community-store/community_store/commit/a71138db250d5c207e49fe3f1287241f04e3f747 https://github.com/concretecms-community-store/community_store/releases/tag/v2.7.8 https://www.vulncheck.com/advisories/concrete-cms-community-store-before-2.7.8-predictable-digital-download-token

Frequently Asked Questions

What is CVE-2026-95653? +

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-95653? +

CVE-2026-95653 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0057, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-95653? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-14602

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a …

CVE-2026-64964

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due …

CVE-2025-69286 9.8

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation …

CVE-2024-47945 9.8

The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs …

CVE-2026-5081 9.1

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value …

CVE-2026-40496 9.1

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using …

CVE-2026-95653