Executive brief
Concrete CMS, a popular content management system, contains a security flaw in its Express Entry Detail block. This component is used to display specific form submissions or data entries on a website. An attacker can exploit this flaw to view private form submissions that they are not authorized to see, potentially exposing sensitive user data or internal records.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Concrete CMS versions 9.5.0 and below within the Express Entry Detail block. The vulnerability is rooted in the application's reliance on the 'exEntryID' parameter, which used sequential integer identifiers. By manipulating this parameter in a network request, an unauthenticated attacker can enumerate and access all Express form submissions. The fix, introduced in version 9.5.1, migrates the system to use 'Express Entry Public Identifier' strings (UUIDs) instead of sequential IDs to prevent predictable resource guessing.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-22: advisory: GitHub Advisory published
- 2026-05-21: patched: Version 9.5.1 released