Is there a patch available for CVE-2026-8236?

Yes, a patch is available for CVE-2026-8236. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8236

Q: What is the CVSS score of CVE-2026-8236?

CVE-2026-8236 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31347 MEDIUM

Missing Authorization (CWE-862)

2026-05-21 ConcreteCMS

GHSA-58c8-vvqw-cm7m

Authentication Bypass Concrete Cms

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:41 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

AnalysisAI

Unauthenticated information disclosure in Concrete CMS 9.5.0 and below allows any network-accessible attacker to enumerate internal site structure data - including page IDs, version numbers, and URL paths - by sending GET requests to the /ccm/system/dialogs/file/usage/{fID} endpoint without any credentials. The flaw combines CWE-862 (Missing Authorization) with a classic IDOR pattern on an integer file ID parameter, and is scored CVSS 4.0 at 6.3 (Medium) by the vendor with PR:N and AC:L, though the AT:P metric indicates that valid file IDs must exist for meaningful data to be returned. No public exploit code and no CISA KEV listing exist at time of analysis.

Technical ContextAI

The vulnerable endpoint /ccm/system/dialogs/file/usage/{fID} is part of Concrete CMS's administrative file management dialog subsystem, designed to show which site pages reference a given file asset. The root cause is CWE-862 (Missing Authorization): the endpoint lacks any session or capability check, allowing it to respond to unauthenticated GET requests. The fID parameter is an integer file ID - a textbook IDOR (Insecure Direct Object Reference) pattern where sequential or guessable IDs map directly to backend objects without access control enforcement. The response leaks internal CMS topology: page IDs, page version numbers, and URL paths that are ordinarily accessible only to authenticated editors. CPE cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* confirms the scope is the concrete_cms application across the 9.x branch through 9.5.0.

RemediationAI

The primary remediation is to upgrade to Concrete CMS 9.5.1, which resolves this vulnerability per the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. If immediate upgrade is not feasible, a compensating control is to block unauthenticated external access to the URL path /ccm/system/dialogs/file/usage/ at the web server, reverse proxy, or WAF layer using a path-based deny rule. Be aware that this path is used by the CMS administrative file usage dialog and blocking it may break legitimate editor workflows - validate in a staging environment before production deployment. For installations already gated behind an authenticated reverse proxy or VPN for all CMS admin access, external exploitability is already prevented. No additional vendor-specified workarounds are documented in the available references.