S4E just found an informational finding from web sayfası erişilebilirlik kontrolü
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
medium·Misconfiguration·Updated Aug 24, 2026

Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsurl
CostFree
2.4k
Times Used
continuous scan runs
1
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
6.3
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Concrete CMSby Concrete CMS
5
Updated Sep 18, 2026View on NVD →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure CVE-2026-8236 Scanner | S4E