Is there a patch available for EUVD-2026-31360?

Yes, a patch is available for EUVD-2026-31360. Update the affected software to the latest version immediately.

Concrete CMS EUVD-2026-31360

Q: What is the CVSS score of EUVD-2026-31360?

EUVD-2026-31360 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7886 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-21 ConcreteCMS

GHSA-p8p9-5953-h9jw

Authentication Bypass Concrete Cms

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:34 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The AddMessage and UpdateMessage conversation controllers accept user-supplied file attachment IDs and load files directly via $em->find(File::class, $attachmentID) without checking per-file permissions (canViewFile()). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting. if a site truly has private files, the owner should set up a private storage location https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations outside of the webroot so that permissions can be checked on view as well. That way, even if a authorized user attaches a file, or otherwise links to it, unauthorized users won't be able to view the file.

AnalysisAI

Insecure Direct Object Reference (IDOR) in Concrete CMS 9.5.0 and below allows authenticated users with conversation posting rights to bypass the file permission system and reference arbitrary files from the CMS file manager. The AddMessage and UpdateMessage conversation controllers accept user-supplied integer attachment IDs and load file objects directly via the ORM without invoking the canViewFile() permission check, enabling unauthorized read and limited write access to files across the system. No public exploit code has been identified at time of analysis, and the ConcreteCMS security team assessed this as a low-severity issue (CVSS 4.0: 2.3), but sites storing sensitive private files are at meaningful risk if those files are served from within the webroot.

Technical ContextAI

Concrete CMS is a PHP-based content management system. The vulnerability exists in the conversation messaging subsystem - specifically the AddMessage and UpdateMessage controllers. These controllers accept an attachments[] array parameter containing integer file IDs. Internally, the code calls $em->find(File::class, $attachmentID) - a Doctrine ORM lookup that retrieves the file entity directly by its primary key without invoking the application-level canViewFile() authorization check. Because Concrete CMS uses sequential integer IDs for file records, the attack surface for enumeration is trivially low. The root cause is classified under CWE-639 (Authorization Through User-Controlled Key), a subtype of IDOR where an application exposes internal object references (here, sequential database primary keys) as user-controllable input without enforcing access control on each lookup. The affected CPE is cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* across the impacted version range. The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:L reflects network-reachable exploitation requiring low privileges and the presence of specific attack requirements (conversation posting access).

RemediationAI

The primary remediation is to upgrade Concrete CMS to version 9.5.1, which is referenced in the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes - note that 9.5.1 as the fix version is inferred from that URL and has not been independently confirmed as a tagged release with the patch merged. For sites that cannot immediately upgrade, the vendor-recommended compensating control is to configure a private file storage location outside the webroot, following the guidance at https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations. By storing private files outside the webroot, the web server will block direct URL access regardless of whether the CMS-level permission check is bypassed, since no HTTP path to the file exists. The trade-off of this workaround is that it requires migrating existing private files to the new storage location and reconfiguring the CMS, which may require testing to avoid breaking existing file references. Sites that do not store sensitive or access-controlled files are at minimal risk even without the workaround.