Is there a patch available for CVE-2026-8237?

Yes, a patch is available for CVE-2026-8237. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8237

Q: What is the CVSS score of CVE-2026-8237?

CVE-2026-8237 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31352 MEDIUM

Missing Authorization (CWE-862)

2026-05-21 ConcreteCMS

GHSA-xpgc-7vc2-8725

Authentication Bypass Concrete Cms

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:41 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The /ccm/frontend/conversations/message_detail endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.

AnalysisAI

Unauthenticated information disclosure in Concrete CMS 9.5.0 and earlier allows remote attackers to enumerate all conversation messages - including content from restricted pages, member-only areas, and the moderation queue - by exploiting a missing authorization check on the /ccm/frontend/conversations/message_detail endpoint. File attachment download URLs are also exposed, compounding the data leakage risk. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the attack requires no credentials and no user interaction, making bulk enumeration trivial once the conversations feature is confirmed active.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization) in Concrete CMS's Conversations block, a page-level comment/discussion feature that supports access restrictions (member-only pages, moderation queues, and group-restricted content areas). The vulnerable endpoint /ccm/frontend/conversations/message_detail retrieves full message records by numeric ID but performs no authorization check to verify whether the requesting party has rights to view the parent page or conversation context. This is a classic IDOR pattern: object IDs are predictable/sequential, and the access control layer is entirely absent rather than merely bypassed. The CVSS 4.0 vector component AT:P (Attack Requirements: Present) signals that a precondition exists - the Conversations block must be deployed and contain messages - but no authentication is needed. CPE data (cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:*) and EUVD-2026-31352 confirm the affected range spans versions 5.0 through 9.5.0.

RemediationAI

The primary remediation is upgrading to Concrete CMS 9.5.1, as indicated by the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. Note that version 9.5.1 as the fix version is inferred from the reference URL and should be independently confirmed against the release notes before deployment. If immediate upgrade is not possible, the most effective compensating control is disabling the Conversations block across all pages, which eliminates the vulnerable endpoint's attack surface entirely at the cost of removing commenting functionality for site visitors. Alternatively, WAF or web server rules can restrict unauthenticated access to the /ccm/frontend/conversations/message_detail endpoint - note this may degrade conversation display for legitimate users if the endpoint is called client-side. For sites where conversations must remain active, removing sensitive or restricted content from conversation threads and moderation queues reduces the data-exposure impact until patching is complete. Rate-limiting requests to the conversations API at the edge can reduce enumeration throughput but does not prevent exploitation.