S4E just found an informational finding from web sayfası erişilebilirlik kontrolü
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
medium·Product Based Web Vulnerabilities·Updated Aug 13, 2026

Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsurl
CostFree
2.7k
Times Used
continuous scan runs
1
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
6.9
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description

Concrete CMS 9.5.0 and below  is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.  Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Concrete CMSby Concrete CMS
5.0
Updated Sep 18, 2026View on NVD →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure CVE-2026-6826 Scanner | S4E