CVE-2026-95653
High
Description
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.
SeverityHigh
CVSS7.5
Exploit probability—
ProductConcretecms-community-store Community Store
PublishedSep 22, 2026
First seenSep 22, 2026
Weakness typeCWE-340CWE-340
How to fix
Update
- concretecms-community-store community_store2.7.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| concretecms-community-store community_store | v < 2.7.8 | 2.7.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.