Executive brief
Concrete CMS, a popular content management system, contains a vulnerability in its conversation messaging system. An authenticated user can bypass file permissions to access or attach private files they should not be able to see by guessing their sequential ID numbers. This could lead to the unauthorized disclosure of sensitive documents or media stored within the CMS file manager.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Concrete CMS versions 9.5.0 and below within the conversation controllers. The AddMessage and UpdateMessage functions accept user-supplied file attachment IDs via the attachments[] parameter and load them using the Entity Manager without performing a canViewFile() permission check. An attacker with basic posting privileges can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system. This allows unauthorized users to attach and potentially view private files. The issue is addressed in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-22: advisory: GitHub Advisory published
- 2026-05-21: patched: Version 9.5.1 released