PT-2026-42556 · Unknown · Concrete Cms

Tristan Mandani · CVE-2026-7886 · Published 2026-05-21 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.1

Description An Insecure Direct Object Reference (IDOR) exists in the 'AddMessage' and 'UpdateMessage' conversation controllers. These controllers accept user-supplied file attachment IDs through the attachments[] parameter and load files using the find(File::class, $attachmentID) function without verifying per-file permissions via canViewFile(). This allows a user with permission to post in any conversation to reference any file in the CMS file manager by its sequential ID, bypassing the file permission system.

Recommendations Update to a version newer than 9.5.0. Set up a private storage location outside of the webroot for private files to ensure permissions are checked during viewing.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-7886

GHSA-P8P9-5953-H9JW

Affected Products

Concrete Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7886.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7886 · Security Note
• https://osv.dev/vulnerability/GHSA-p8p9-5953-h9jw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-7886 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note
• https://twitter.com/infoflowcloud/status/2057785056245027310 · Twitter Post
• https://t.me/cveNotify/164640 · Telegram Post
• https://t.me/cveNotify/215662 · Telegram Post
• https://twitter.com/CVEnew/status/2057783211841753520 · Twitter Post