Executive brief
Concrete CMS, a platform used for building and managing websites, contains a security flaw that allows unauthorized visitors to view information about how files are used across the site. By accessing a specific web address, an attacker can see a list of every page that references a particular file, including the names and full web addresses of pages that are supposed to be private or restricted. This could lead to the discovery of hidden content or sensitive internal page structures.
Technical details
A missing permission check in the usage controller of Concrete CMS allows unauthenticated attackers to access the endpoint `/ccm/system/dialogs/file/usage/{fID}`. By providing a file ID (fID), an attacker can retrieve a comprehensive list of all pages referencing that file. The disclosed data includes page IDs, handles, and full URLs, even for pages that have restricted access permissions. This vulnerability is classified as an Information Exposure (CWE-200) and was addressed in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory
- 2026-05-21: patched: Fixed in version 9.5.1