Is there a patch available for EUVD-2026-31349?

Yes, a patch is available for EUVD-2026-31349. Update the affected software to the latest version immediately.

Concrete CMS EUVD-2026-31349

Q: What is the CVSS score of EUVD-2026-31349?

EUVD-2026-31349 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8239 MEDIUM

Missing Authorization (CWE-862)

2026-05-21 ConcreteCMS

GHSA-2xp7-rpvc-pjwc

Authentication Bypass Concrete Cms

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:44 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.

AnalysisAI

Insecure Direct Object Reference (IDOR) in Concrete CMS 9.5.0 and earlier allows unauthenticated remote attackers to enumerate arbitrary conversation message IDs via the /ccm/frontend/conversations/get_rating endpoint, confirming message existence and leaking rating scores. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L) indicates no authentication is required but a prerequisite condition must be met - likely the Conversations module being enabled and publicly reachable. No public exploit has been identified and this CVE is not listed in CISA KEV, placing it in the low-priority tier despite its network-accessible nature.

Technical ContextAI

Concrete CMS is a PHP-based content management system with a built-in Conversations/Comments module. The vulnerable endpoint /ccm/frontend/conversations/get_rating is part of the front-end conversation API and accepts a message ID parameter without performing authorization checks on whether the requesting user is permitted to access the referenced message. CWE-862 (Missing Authorization) precisely describes the root cause: the application fails to verify that the actor has the right to access the resource identified by the supplied object reference. This allows sequential or arbitrary ID enumeration to map out conversation content structure. The CPE string cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* spans all versions, with affected range confirmed as 5.0 through 9.5.0 per EUVD-2026-31349.

RemediationAI

Upgrade to Concrete CMS 9.5.1, which is indicated as the fix release per the vendor's release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. If an immediate upgrade is not feasible, the most targeted compensating control is to disable the Conversations/Comments feature entirely in the CMS settings if it is not actively used - this eliminates the vulnerable endpoint from the attack surface with no side effects for sites not relying on the feature. Alternatively, restrict access to the path /ccm/frontend/conversations/get_rating via web server deny rules (nginx deny all location block or Apache Require all denied directive); note this will break front-end rating display for legitimate users. No other vendor-documented workarounds are available. The exact patch version 9.5.1 is inferred from the reference URL and not independently verified against a tagged release; confirm the fix is present before removing compensating controls.