Executive brief
Concrete CMS is a content management system that uses a REST API to manage content entries. A flaw in the Express entry REST API endpoint allows users with read access to enumerate all entries in that system, including ones they should not be able to view. This could expose private content identifiers, URLs, labels, dates, and other associated data to unauthorized users.
Technical details
The vulnerability is a missing authorization check in the Concrete CMS REST API's Express entry collection endpoint. The per-entry view permission check was disabled, allowing an OAuth token with read scope for an Express entity to enumerate all entries regardless of the user's actual permissions. An authenticated attacker with at least read-scope OAuth credentials can call the Express list endpoint to retrieve all entries and their metadata (public identifier, URL, label, dates, and any attribute or associated-entry data via the includes parameter). The vulnerability affects versions 9.2.0 through 9.5.2 and has been assigned CVSS v4.0 score 6.0 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H).
Affected products
- Concrete CMS Concrete CMS 9.2.0 to 9.5.2
Timeline
- 2026-09-11: disclosed