Executive brief
Concrete CMS, a platform used for building and managing websites, is affected by a security flaw that allows unauthorized users to see information about hidden pages. An attacker can discover the existence of private drafts and restricted pages, along with their titles, web addresses, and author names. This could lead to the exposure of sensitive internal information or upcoming content before it is officially published.
Technical details
Concrete CMS 9.5.0 and below contains an improper access control vulnerability (CWE-284) within its summary template functionality. When a summary template is configured, the system fails to properly validate permissions before rendering metadata, allowing unauthenticated remote attackers to disclose the existence of private, draft, and restricted pages. Leaked information includes page titles, paths, descriptions, and author metadata. The vulnerability is addressed in version 9.5.1 by implementing stricter permission checks (canViewRenderedSummaryTemplates) within the summary template drivers.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed: NVD Published Date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: patched: GitHub Advisory updated with patch information for version 9.5.1