PT-2026-42554 · Unknown · Concrete Cms

Tristan Madani · Published 2026-05-21 · Updated 2026-05-22 · CVE-2026-7881

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.5.0 and earlier

Description An Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input, exists in the Express Entry Detail block. By manipulating the exEntryID parameter, unauthorized users can gain access to all Express form submissions.

Recommendations Update Concrete CMS to a version later than 9.5.0. As a temporary workaround, restrict access to the Express Entry Detail block or avoid using the exEntryID parameter until the update is applied.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-7881

Affected Products

Concrete Cms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-7881 · Security Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note
• https://t.me/cveNotify/164639 · Telegram Post