PT-2026-42558 · Unknown · Concrete Cms

Winston Crooker · CVE-2026-8236 · Published 2026-05-21 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.5.0 and earlier

Description An Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input, combined with a missing authentication gate allows unauthorized users to retrieve internal site structure data. By sending a GET request to the endpoint '/ccm/system/dialogs/file/usage/{fID}', an attacker can use the fID variable to obtain page IDs, versions, and URL paths.

Recommendations Update to a version later than 9.5.0. As a temporary workaround, restrict access to the '/ccm/system/dialogs/file/usage/{fID}' endpoint to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-8236

GHSA-58C8-VVQW-CM7M

Affected Products

Concrete Cms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8236.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-8236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8236 · Security Note
• https://osv.dev/vulnerability/GHSA-58c8-vvqw-cm7m · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note
• https://t.me/cveNotify/164724 · Telegram Post