PT-2026-42556 · Unknown · Concrete Cms

Tristan Mandani · Published 2026-05-21 · Updated 2026-05-22 · CVE-2026-7886

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.1

Description An Insecure Direct Object Reference (IDOR) exists in the 'AddMessage' and 'UpdateMessage' conversation controllers. These controllers accept user-supplied file attachment IDs through the attachments[] parameter and load files using the find(File::class, $attachmentID) function without verifying per-file permissions via canViewFile(). This allows a user with permission to post in any conversation to reference any file in the CMS file manager by its sequential ID, bypassing the file permission system.

Recommendations Update to a version newer than 9.5.0. Set up a private storage location outside of the webroot for private files to ensure permissions are checked during viewing.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-7886

Affected Products

Concrete Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-7886 · Security Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note
• https://t.me/cveNotify/164640 · Telegram Post
• https://twitter.com/CVEnew/status/2057783211841753520 · Twitter Post
• https://twitter.com/infoflowcloud/status/2057785056245027310 · Twitter Post