Executive brief
Concrete CMS, a popular website building and content management platform, contains an authorization flaw in its user selector autocomplete endpoint that allows unauthenticated attackers to enumerate all user accounts in the system. By exploiting this vulnerability, an attacker can extract the usernames, email addresses, and internal user IDs of all administrative users without needing any credentials, exposing sensitive information about the site's administrative structure.
Technical details
This is an authorization bypass vulnerability in the user selector autocomplete endpoint (/ccm/system/user/autocomplete) in Concrete CMS 9.0.0–9.5.2. The endpoint fails to check whether the caller has permission to access it; instead, it validates only a CSRF-style token that is bound to display options rather than the caller's identity or permissions. Because this token is issued to anonymous visitors (the selector renders without authorization checks), an unauthenticated attacker can reach the endpoint. By submitting an empty query, the attacker bypasses filters and retrieves all user records, allowing complete enumeration of internal user IDs, usernames, and email addresses for all accounts, including the super-administrator. No password hashes or session tokens are exposed. A patch is expected to be available.
Affected products
- Concrete CMS Concrete CMS 9.0.0 through 9.5.2
Timeline
- 2026-09-15: disclosed