GHSA-xpgc-7vc2-8725

ghsaUSosv

Concrete CMS is vulnerable to IDOR

view advisory published 2026-05-22Licence: CC-BY-4.0

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2026-8237USmedium5.3OT elevatedExploit
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticat…
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan