CVE

CVE-2026-6826

6.9

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

concrete cms

Updated Sep 18, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes https://www.concretecms.org/security https://nvd.nist.gov/vuln/detail/CVE-2026-6826 https://vulnerability.circl.lu/vuln/cve-2026-6826 Remediation: Update to the latest version beyond 9.5.0.

Used 2.7k times · 1 assets checked · url

Scanner page →Run scanner

CVE history: concrete cms

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →