EUVD-2026-74282
GHSA-6h73-cg9r-6xcf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AT:P prerequisite (specific public-page layout with config-emitting restricted sub-block) maps to AC:H; confidentiality capped at L with no integrity or availability impact.
Primary rating from Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de).
CVSS VectorVendor: ff5b8ace-8b95-4078-9743-eac1ca5451de
Lifecycle Timeline
2DescriptionCVE.org
Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration - such as a site's configured Google Maps API key - from any public page embedding an affected Stack, Container, or layout area, despite the block-level permission restriction. Any sub-block type whose asset or header hooks output configuration values is affected. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
AnalysisAI
Concrete CMS versions below 9.5.3 leaks restricted sub-block configuration values - including Google Maps API keys - to unauthenticated visitors on public pages. The asset and header registration pipeline processes sub-blocks nested in Stacks, Containers, and layout areas without verifying whether the requesting user holds permission to view each sub-block, so configuration output emitted by those hooks reaches any visitor regardless of block-level restrictions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must run Concrete CMS 5.x at or below version 9.5.2. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) establishes this as network-accessible and unauthenticated, but AT:P (Partial Attack Requirements) is the key qualifier: exploitation depends on site-specific configuration - a publicly accessible page must embed a Stack or Container holding a permission-restricted, configuration-value-emitting sub-block. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Concrete CMS 9.5.3, which is the vendor-confirmed patched release documented at https://documentation.concretecms.org/9-x/developers/introduction/version-history/953-release-notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today