PT-2026-42540 · Unknown · Concrete Cms

Eldudarino Trinsec · CVE-2026-6826 · Published 2026-05-21 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.5.0 and earlier

Description An issue exists where a missing permission check in the usage controller allows unauthenticated visitors to disclose file usage information. By requesting the endpoint '/ccm/system/dialogs/file/usage/{fID}' using any file ID via the fID variable, an attacker can obtain a list of every page referencing that file, including page IDs, handles, and full URLs. This disclosure includes pages that are otherwise restricted by permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-6826

GHSA-4G7Q-44QP-CC5C

Affected Products

Concrete Cms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6826.json · Exploit
• https://osv.dev/vulnerability/GHSA-4g7q-44qp-cc5c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6826 · Security Note
• https://osv.dev/vulnerability/CVE-2026-6826 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://twitter.com/dailycve/status/2059351064642535631 · Twitter Post
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note
• https://t.me/CVEtracker/54544 · Telegram Post