GHSA-xpgc-7vc2-8725Medium

Concrete CMS is vulnerable to IDOR

Published
May 22, 2026
Last Modified
June 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-8237 →

📋 Description

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The /ccm/frontend/conversations/message_detail endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed.

🎯 Affected products1

  • composer/concrete5/concrete5:< 9.5.1

🔗 References (3)