CVE-2026-8239

CVE-2026-8239 CVE-2026-8239 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS 9.5.0 and earlier.The vulnerability exists in the /ccm/frontend/conversations/getrating endpoint, which allows an attacker to determine whether a conversation message exists and retrieve i...

CVE-2026-8239 Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/getrating' endpoint confirms existence and returns rating score for any message by ID. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...