CVE-2026-8237

MEDIUM

Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-8237. PoCs published by aj2108.

AI-analyzed exploit summary Detailed technical analysis of CVE-2026-8237, an IDOR vulnerability in Concrete CMS 9.5.0 and earlier, caused by missing authorization checks in the `/ccm/frontend/conversations/message_detail` endpoint. The writeup includes root cause analysis, attack scenarios, and conceptual vulnerable/patched code examples.

Description

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.

Exploits (1)

github WRITEUP

by aj2108 · poc

https://github.com/aj2108/CVE-2026-8237

View Code ZIP pw:eip

Detailed technical analysis of CVE-2026-8237, an IDOR vulnerability in Concrete CMS 9.5.0 and earlier, caused by missing authorization checks in the `/ccm/frontend/conversations/message_detail` endpoint. The writeup includes root cause analysis, attack scenarios, and conceptual vulnerable/patched code examples.

Classification

Writeup 98%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Concrete CMS 9.5.0 and earlier

No auth needed

Prerequisites: Access to the vulnerable endpoint (`/ccm/frontend/conversations/message_detail`) · Ability to enumerate or guess valid `messageId` values

MITRE ATT&CK

T1005 - Data from Local System T1552 - Unsecured Credentials

mistral-large-3 · analyzed Aug 01, 2026 Full analysis →

References (1)

Core 1

Core References

Release Notes release-notes

https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

Scores

CVSS v3 5.3

EPSS 0.0020

EPSS Percentile 10.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (3)

Concrete CMS/Concrete CMS 5.0 - 9.5.0

concrete5/concrete5 0 - 9.5.1Packagist

concretecms/concrete_cms < 9.5.1

Published May 21, 2026

Tracked Since May 22, 2026