PT-2026-42545 · Unknown · Concrete Cms

Lalalala5678 · CVE-2026-8205 · Published 2026-05-21 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.5.0 and earlier

Description An authorization bypass exists in the Calendar Block. The function action get events() fails to verify the canView permission on the calendar, which allows the disclosure of restricted event details.

Recommendations Update to a version later than 9.5.0. As a temporary workaround, restrict access to the Calendar Block or the action get events() function until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2026-8205

GHSA-46XH-7854-F568

Affected Products

Concrete Cms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8205.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-8205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8205 · Security Note
• https://osv.dev/vulnerability/GHSA-46xh-7854-f568 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note
• https://t.me/CVEtracker/54551 · Telegram Post
• https://t.me/cveNotify/164721 · Telegram Post