Is there a patch available for CVE-2026-8238?

Yes, a patch is available for CVE-2026-8238. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8238

Q: What is the CVSS score of CVE-2026-8238?

CVE-2026-8238 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31354 MEDIUM

Missing Authorization (CWE-862)

2026-05-21 ConcreteCMS

GHSA-qv3x-mffx-9gw8

Authentication Bypass Concrete Cms

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:44 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.

AnalysisAI

Insecure Direct Object Reference (IDOR) in Concrete CMS 9.5.0 and earlier exposes the full content of any conversation message through an unauthenticated frontend API endpoint, including messages from restricted pages, member-only areas, and the moderation queue. Unauthenticated remote attackers can enumerate message records and harvest file attachment download URLs by querying /ccm/frontend/conversations/message_page without credentials. No public exploit code has been identified and no CISA KEV listing exists; however, the network-accessible unauthenticated attack vector (PR:N, AV:N) makes patching a priority for any public-facing installation using the Conversations feature.

Technical ContextAI

The vulnerability is classified under CWE-862 (Missing Authorization), a root-cause class where server-side logic fails to verify the requesting party's permission before returning a resource. The frontend endpoint /ccm/frontend/conversations/message_page is part of Concrete CMS's built-in Conversations module - a commenting and discussion system that can be attached to pages. The flaw allows message identifiers to be enumerated or iterated without any authorization check, enabling retrieval of arbitrary message records regardless of the page-level access controls (restricted pages, member-only zones, or moderation queue states) that would normally gate visibility. CPE data (cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:*) confirms the vulnerability spans the entire Concrete CMS application product, not a plugin or optional module. The CVSS 4.0 AT:P modifier (Attack Requirements: Present) indicates some environmental or configuration prerequisite must be in place - specifically, the Conversations feature must be active and contain message data.

RemediationAI

Upgrade to Concrete CMS 9.5.1, which addresses this vulnerability per vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes; this is the primary and recommended fix. If immediate upgrade is not possible, administrators can restrict access to /ccm/frontend/conversations/message_page at the web server layer (e.g., an nginx location block or Apache Location directive) to require authenticated sessions, though this may interfere with legitimate frontend conversation loading for logged-in users and should be tested against site functionality. A higher-impact but zero-side-effect workaround is to disable the Conversations feature entirely within the Concrete CMS dashboard if discussion functionality is not required, fully eliminating the exposed endpoint at the cost of all commenting capability. No compensating controls short of these measures can reliably prevent enumeration of message IDs once the endpoint is reachable.