Concrete CMS CVE-2026-6826

No special conditions required - remote unauthenticated exploitation against default Concrete CMS 9.5.0 and below installations. The CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no elevated privilege, no specific configuration flag, and no user interaction are needed. The only practical limiting factor is that the attacker must know or enumerate numeric file IDs, which in Concrete CMS are typically sequential integers starting from 1, making brute-enumeration trivial. Exploitation impact is bounded to read-only metadata disclosure (VC:L) - no file content, credentials, or write access are exposed through this endpoint alone.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a fully unauthenticated, low-complexity, no-interaction network attack - the lowest possible barrier to exploitation. Impact is limited to low confidentiality (VC:L) with zero integrity or availability impact, which appropriately anchors the score below critical. No CISA KEV listing and no confirmed POC code exist at time of analysis, so EPSS-equivalent opportunistic exploitation risk is moderate. The real-world risk is primarily reconnaissance: an attacker can silently enumerate the full internal page graph, discovering restricted draft pages, staff-only sections, or staged content paths before launching a targeted credential or social-engineering attack. For sites with sensitive restricted content (intranets, member portals, staged content), the effective risk is higher than the raw score implies. No conflicting signals are present in the available data - CVSS vector and description are consistent.

An unauthenticated attacker sends sequential HTTP GET requests to https://target-site.com/ccm/system/dialogs/file/usage/1, /2, /3, and so on. For each valid file ID, the CMS returns a JSON or HTML response listing every page that references that file, including page IDs, URL handles, and full URLs - even for pages restricted to authenticated roles. Within minutes, the attacker builds a complete map of the site's content structure, including hidden draft pages and access-controlled sections, enabling targeted follow-on attacks. No public exploit code is required; a simple curl loop or browser is sufficient given the AV:N/AC:L/PR:N/UI:N vector.