Is there a patch available for CVE-2026-8204?

Yes, a patch is available for CVE-2026-8204. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8204

Q: What is the CVSS score of CVE-2026-8204?

CVE-2026-8204 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31348 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-21 ff5b8ace-8b95-4078-9743-eac1ca5451de

GHSA-x2fp-hj8c-mmxh

Authentication Bypass Concrete Cms

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 21:39 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

AnalysisAI

Cross-calendar data disclosure in Concrete CMS 9.5.0 and below exposes private calendar event data to unauthenticated remote attackers via an authorization bypass (CWE-639) in the Calendar Event Frontend Dialog. A publicly accessible calendar block serves as a required pivot point, allowing attackers to reference and retrieve event data from private calendars within the same installation. No public exploit has been identified at time of analysis; the vendor assigned a CVSS 4.0 score of 6.3, reflecting constrained confidentiality impact and a prerequisite attack condition (AT:P).

Technical ContextAI

The vulnerability resides in Concrete CMS's Calendar module, specifically the Frontend Dialog component responsible for rendering calendar event details to site visitors. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause as an insecure direct object reference (IDOR) pattern: the dialog likely accepts a user-supplied identifier - such as an event ID or calendar ID - without verifying that the requesting party holds authorization to access the referenced calendar's data. The CVSS 4.0 vector element AT:P (Attack Requirements: Present) confirms that a specific precondition must exist in the target environment, namely a deployed and publicly accessible calendar block, before exploitation is feasible. No CPE strings were supplied in the source intelligence, but the affected scope is Concrete CMS version 9.5.0 and all prior releases in the 9.x branch. The vendor reference URL points to the 9.5.1 release notes, indicating the authorization check was introduced or corrected in that release.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, as indicated by the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes; this is the fix version inferred from the provided reference, though it has not been independently verified against a separate published security advisory. If immediate patching is not feasible, administrators should assess whether any public calendar blocks are deployed in installations that also host private calendars - removing or disabling all public-facing calendar blocks eliminates the AT:P precondition entirely and fully mitigates exploitation risk, at the cost of removing legitimate public calendar functionality for site visitors. Restricting HTTP access to calendar frontend dialog endpoints via a WAF or reverse-proxy rule targeting calendar API paths may reduce exposure but is not a confirmed standalone compensating control given the lack of endpoint detail in available data. No generic network-level mitigations such as firewall rules are applicable given that the attack vector is standard web traffic.