PT-2026-42540 · Unknown · Concrete Cms

Eldudarino Trinsec · Published 2026-05-21 · Updated 2026-05-26 · CVE-2026-6826

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.5.0 and earlier

Description An issue exists where a missing permission check in the usage controller allows unauthenticated visitors to disclose file usage information. By requesting the endpoint '/ccm/system/dialogs/file/usage/{fID}' using any file ID via the fID variable, an attacker can obtain a list of every page referencing that file, including page IDs, handles, and full URLs. This disclosure includes pages that are otherwise restricted by permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-6826

Affected Products

Concrete Cms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-6826 · Security Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note
• https://t.me/CVEtracker/54544 · Telegram Post
• https://twitter.com/dailycve/status/2059351064642535631 · Twitter Post