Concrete CMS CVE-2026-7890

Exploitation requires the attacker to hold a high-privileged page editor account within the target Concrete CMS installation - confirmed by CVSS PR:H in the vendor-provided vector. The RSS Displayer block must be available to that editor (CVSS AT:P - a prerequisite attack condition is explicitly required). The CMS application server must be capable of making outbound HTTP requests and must follow redirects to the target internal address. Exploitation is limited by: (1) the high privilege bar - casual external attackers without valid editor credentials cannot trigger this; (2) the RSS Displayer block dependency - environments that do not use this block are not exposed; (3) network egress controls - if outbound connections from the application server to internal ranges are already blocked, redirect-based SSRF impact is nullified; and (4) scoped impact - even successful exploitation yields at most low integrity effects and limited internal network probing (VC:N per CVSS), not remote code execution or credential exfiltration.

The CVSS v4.0 score of 2.1 is unusually low and accurately reflects multiple converging risk-reduction factors. PR:H (High Privileges Required) is the dominant constraint: the attacker must already possess a valid, high-privileged page editor account within the Concrete CMS installation, restricting realistic exploitation to insider threats, credential-compromise follow-on attacks, or misconfigured access control environments. AT:P further narrows the attack surface by requiring the RSS Displayer block to be present and available. Impact signals reinforce the low score: VC:N rules out confidentiality breaches on the CMS host itself, VI:L indicates only marginal integrity effects, and SC:L acknowledges limited subsequent-system confidentiality exposure consistent with internal network probing rather than meaningful data exfiltration. No EPSS score is available in the provided data, making probabilistic exploitation frequency assessment impossible. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, meaning no evidence of active or widespread exploitation exists at time of analysis. The overall picture is a real but heavily gated vulnerability: not a critical priority for most organizations unless the threat model includes malicious insiders or environments where high-privilege CMS accounts are broadly distributed.

An attacker who has obtained or already holds a high-privileged page editor account on a Concrete CMS 9.5.0 installation edits a page, inserts an RSS Displayer block, and configures it with a URL pointing to an attacker-controlled HTTP server. That server responds with an HTTP redirect to an internal address such as http://169.254.169.254/latest/meta-data/ (cloud instance metadata) or an internal REST API endpoint. The CMS server follows the redirect and fetches the internal resource, potentially returning contents to the attacker or confirming internal infrastructure topology. No public exploit code has been identified at time of analysis.