Executive brief
Concrete CMS, a popular content management system, contains a security flaw that allows unauthorized individuals to view internal website structure data. By accessing a specific web address, an attacker can see page IDs, version history, and URL paths that should normally be protected. This information could be used to map out the website's private architecture or assist in further targeted attacks.
Technical details
Concrete CMS versions 9.5.0 and below are vulnerable to an Insecure Direct Object Reference (IDOR) combined with a missing authentication gate. The vulnerability exists in the /ccm/system/dialogs/file/usage/{fID} endpoint, which fails to verify if a requester is authenticated or authorized before processing the request. By supplying an integer file ID (fID) in the URL, an unauthenticated remote attacker can retrieve internal site structure data, including page IDs, versions, and URL paths. This information disclosure is caused by a failure to implement proper authorization checks (CWE-862) on the affected endpoint. The issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed: NVD Published Date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: patched: GitHub Advisory reviewed and updated with patch information