CVE-2026-8236

🗓️ 21 May 2026 20:59:07Reported by ConcreteCMSType

cve🔗 web.nvd.nist.gov👁 109 Views🌐 WEB

CVE-2026-8236: Concrete CMS 9.5.0 and earlier expose internal data via direct object reference.

Reporter	Title	Published	Views	Family All 15
attackerkb	CVE-2026-8236	21 May 202620:59	–	attackerkb
CNNVD	Concrete CMS security vulnerabilities	21 May 202600:00	–	cnnvd
Cvelist	CVE-2026-8236 Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID}	21 May 202620:59	–	cvelist
EUVD	EUVD-2026-31347	22 May 202600:31	–	euvd
Github Security Blog	Concrete CMS is vulnerable to IDOR combined with a missing authentication gate	22 May 202600:31	–	github
Mend	CVE-2026-8236	21 May 202620:59	–	mend
Nuclei	Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure	3 Nov 202602:03	–	nuclei
NVD	CVE-2026-8236	21 May 202622:16	–	nvd
osv_cve	CVE-2026-8236 Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID}	21 May 202620:59	–	osv_cve
osv_ghsa	GHSA-58C8-VVQW-CM7M Concrete CMS is vulnerable to IDOR combined with a missing authentication gate	22 May 202600:31	–	osv_ghsa

NVD

Vulners

Node

concretecms concrete_cmsRange<9.5.1

[
  {
    "vendor": "Concrete CMS",
    "product": "Concrete CMS",
    "collectionURL": "https://github.com/concretecms/concretecms",
    "repo": "https://github.com/concretecms/concretecms",
    "versions": [
      {
        "status": "affected",
        "version": "5",
        "lessThanOrEqual": "9.5.0",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
documentation	www.documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

Parameter	Position	Path	Description	CWE
{fID}	path	/ccm/system/dialogs/file/usage/{fID}	The endpoint accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) without proper authentication.	CWE-862

23 Jul 2026 16:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.3

CVSS 46.3

EPSS0.00675

SSVC

CWE-862