Executive brief
Concrete CMS before version 9.5.3 contains an unauthenticated information disclosure vulnerability in its Express entry search endpoint. An attacker without user credentials can query this endpoint to retrieve sensitive entry data and attribute values that should only be visible to authorized users. This could expose confidential business information or personal data depending on what is stored in Express entries.
Technical details
The vulnerability is an authorization bypass in a legacy Express entry search endpoint that fails to invoke the canViewExpressEntries() permission check. An unauthenticated attacker with knowledge of an Express entity identifier can make network requests to this endpoint to retrieve entry search results in JSON format, bypassing the normal permission validation applied by the dashboard and CSV export flows. For Express entities that do not support entry-specific permissions (supportsEntrySpecificPermissions() returns false), the EntryList::ignorePermissions() method further disables per-entry permission filtering. The endpoint is network-accessible and requires no authentication or user interaction, allowing remote enumeration of sensitive data.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 9.5.3