Executive brief
Concrete CMS, a platform used for building and managing websites, contains a flaw that allows unauthorized users to access restricted files. An attacker can download files that should be protected by permissions, and if a file is password-protected, anyone with the password can access it even if they do not have the required system permissions. This could lead to the exposure of sensitive documents or private data stored within the CMS.
Technical details
A missing authorization vulnerability exists in Concrete CMS versions 9.5.0 and below within the `submit_password()` method of `concrete/controllers/single_page/download_file.php`. The application fails to perform a `view_file` permission check when processing file downloads through this method. Consequently, files without passwords can be downloaded by any user, and password-protected files can be accessed by anyone possessing the password, regardless of their assigned CMS permissions. This bypasses the intended access control list (ACL) logic. The issue is addressed in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed: NVD Published Date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: other: Advisory reviewed and updated