CVE-2026-95653CWE-340

CVE-2026-95653

High · published September 22, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
46.4
In the wild
Unconfirmed
What it is

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00569 · 46.4th percentile
Weakness
CWE-340 · Generation of Predictable Numbers or Identifiers
Published
2026-09-22T20:18Z
References (6)
https://github.com/concretecms-community-store/community_store · [email protected]https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L17 · [email protected]https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L45 · [email protected]https://github.com/concretecms-community-store/community_store/commit/a71138db250d5c207e49fe3f1287241f04e3f747 · [email protected]https://github.com/concretecms-community-store/community_store/releases/tag/v2.7.8 · [email protected]https://www.vulncheck.com/advisories/concrete-cms-community-store-before-2.7.8-predictable-digital-download-token · [email protected]
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 1%
    epss
  • 22 SEP 15:24Z
    Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
    cvelistv5