CVE-2026-18110-PoC

CVE-2026-18110 — Concrete CMS Unauthenticated User Enumeration Summary Concrete CMS 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. Thi...