Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
Priority MEDIUM 44CWE-340Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00569 47th percentileScored 2026-11-07
Fix Fixed community_store (concretecms-community-store): 2.7.8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| concretecms-community-store | community_store | before 2.7.8 | 2.7.8 | Patch available | CNA |
- community_store Vendorconcretecms-community-store Affected before 2.7.8 Fixed in 2.7.8 Patch available CNA
Remediation
- Fix · CNA community_store (concretecms-community-store) Fixed in 2.7.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-95653
- 2026-10-03 Alias added: GHSA-4m3m-829w-5q37
References
Patch 1
Other 4
- https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L17
- https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L45
- community_store v2.7.8 Release Notes
- https://github.com/concretecms-community-store/community_store
More concretecms-community-store vulnerabilities
- TI-2026-63091 Concrete CMS Community Store before 2.7.8 Stored XSS CVSS 4.0HIGH 8.6
Sources
- CVE-2026-95653 · CVE Program
- CVE-2026-95653 · NVD
- FIRST EPSS
- GHSA-4m3m-829w-5q37 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences