S4E just found an informational finding from web sayfası erişilebilirlik kontrolü
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
medium·Misconfiguration·Updated Aug 19, 2026

Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
2.2k
Times Used
continuous scan runs
1
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
6.3
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Concrete CMSby Concrete CMS
5.0
Updated Sep 18, 2026View on NVD →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR) CVE-2026-8237 Scanner | S4E