CVE

CVE-2026-8236

6.3

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

concrete cms

Updated Sep 18, 2026View on NVD →

S4E scanner

mediumMisconfiguration~10 seconds

Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request. References: https://documentation.concretecms.org/9-x/developers/9.5.1-security-releases Remediation: Update to a version later than 9.5.0 or the latest available version.

Used 2.4k times · 1 assets checked · url

Scanner page →Run scanner

CVE history: concrete cms

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →