GHSA-chfm-cm6h-q5x7

ghsaUSosv

Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block

view advisory published 2026-05-22Licence: CC-BY-4.0

Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions. The Concrete CMS security team thanks Tristan Madani for reporting this issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-7881US	medium4.3	0.21% (10th)	—	2026-05-21
Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized ac…

references

External citations — patches, advisories, analysis.

https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notesWEB
https://github.com/concretecms/concretecmsPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2026-7881ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan