Executive brief
Concrete CMS versions below 9.5.3 failed to enforce access control when registering view assets for blocks within Stack, Container, or layout areas. An unauthenticated visitor could extract sensitive configuration values—such as API keys—from restricted blocks' asset registration output on any public page, bypassing the intended block-level permission restrictions.
Technical details
The vulnerability is an information disclosure (CWE-200) in Concrete CMS's block asset registration mechanism. The system did not verify that the requesting user had permission to view a sub-block before registering and emitting its assets and header hooks, which may contain sensitive configuration values. The attack requires network access to a public page embedding an affected Stack, Container, or layout area, requires no authentication, and no user interaction. An attacker can recover configuration secrets emitted during asset registration. The vulnerability affects versions before 9.5.3 and was fixed in that release.
Affected products
- Concrete CMS Concrete CMS below 9.5.3
Timeline
- 2026-09-08: disclosed