Concrete CMS EUVD-2026-31352

The Concrete CMS Conversations block must be enabled and deployed on at least one page within the target site, and that conversation must contain messages - this is the AT:P precondition in the CVSS 4.0 vector. No authentication is required (PR:N confirmed by CVSS vector); exploitation is entirely unauthenticated and remote. No user interaction is needed (UI:N). The vulnerability does not affect sites that do not use the Conversations block at all. Exploitation is read-only: the CVSS vector confirms no integrity impact (VI:N) and no availability impact (VA:N), meaning attackers can only exfiltrate data, not modify or destroy it. Instances running Concrete CMS 9.5.1 or later are not affected.

The CVSS 4.0 score of 6.3 reflects a moderate severity: the attack vector is network (AV:N), complexity is low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N), but impact is bounded - low confidentiality impact on the vulnerable component (VC:L) with zero integrity or availability consequence. The AT:P component is a meaningful constraint: exploitation only succeeds if the Conversations feature is active and populated with messages, which limits the total exposed population to sites actually using this block. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified numerically. No CISA KEV listing exists and no public exploit code has been identified, indicating this is not currently subject to widespread automated exploitation. Despite the bounded CVSS impact rating, the practical risk is meaningful: an attacker can systematically harvest sensitive organizational communications from behind access controls (restricted pages, moderation queues, member areas) without any authentication, and the included file attachment URLs extend the breach surface to uploaded documents. This should be treated as a moderate-priority patch - not a drop-everything emergency, but a real unauthorized data access risk for any site relying on Concrete CMS conversations for sensitive or internal communications.

An attacker identifies a publicly accessible Concrete CMS site and confirms the Conversations feature is active by observing comment threads on any public page. The attacker then scripts sequential GET requests to /ccm/frontend/conversations/message_detail?message_id=[n] without any authentication headers, iterating through integer IDs to extract the full text of messages including those belonging to restricted-page discussions, member-only forums, and content pending moderator approval. No public exploit code has been identified at time of analysis, but the enumeration technique requires only a basic HTTP client and is fully automatable.