CVE-2026-18110: Concrete CMS user selector autocomplete authorization bypass

CVE-2026-18110 · Severity: high · CVSS 7.5 · Published 2026-09-15

Concrete CMS, a popular website building and content management platform, contains an authorization flaw in its user selector autocomplete endpoint that allows unauthenticated attackers to enumerate all user accounts in the system. By exploiting this vulnerability, an attacker can extract the usernames, email addresses, and internal user IDs of all administrative users without needing any credentials, exposing sensitive information about the site's administrative structure.

Technologies: Concrete CMS. Vendors: Concrete CMS.

Quick answers

Is CVE-2026-18110 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18110 being exploited in the wild.
How severe is CVE-2026-18110?
High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?
Concrete CMS 9.0.0 through 9.5.2.
Is there a fix for CVE-2026-18110?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18110 attacked?
It is attacked over the network.
Am I affected by CVE-2026-18110?
Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authorization bypass vulnerability in the user selector autocomplete endpoint (/ccm/system/user/autocomplete) in Concrete CMS 9.0.0–9.5.2. The endpoint fails to check whether the caller has permission to access it; instead, it validates only a CSRF-style token that is bound to display options rather than the caller's identity or permissions. Because this token is issued to anonymous visitors (the selector renders without authorization checks), an unauthenticated attacker can reach the endpoint. By submitting an empty query, the attacker bypasses filters and retrieves all user records, allowing complete enumeration of internal user IDs, usernames, and email addresses for all accounts, including the super-administrator. No password hashes or session tokens are exposed. A patch is expected to be available.

Affected products

  • Concrete CMS Concrete CMS 9.0.0 through 9.5.2

Timeline

  • 2026-09-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.