PT-2026-42545 · Concrete Cms · Concrete Cms

Lalalala5678 · Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-8205

NVD

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action get events does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks lalalala5678 for reporting.

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2026-8205

Affected Products

Concrete Cms

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-8205 · Security Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note