CVE-2026-8239

MEDIUM

Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-8239. PoCs published by aj2108.

AI-analyzed exploit summary Detailed technical analysis of CVE-2026-8239, an IDOR vulnerability in Concrete CMS 9.5.0 and earlier, where the /ccm/frontend/conversations/get_rating endpoint fails to perform authorization checks, allowing attackers to enumerate message IDs and retrieve rating scores without proper permissions.

Description

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.

Exploits (1)

github WRITEUP
by aj2108 · poc
https://github.com/aj2108/CVE-2026-8239

Detailed technical analysis of CVE-2026-8239, an IDOR vulnerability in Concrete CMS 9.5.0 and earlier, where the /ccm/frontend/conversations/get_rating endpoint fails to perform authorization checks, allowing attackers to enumerate message IDs and retrieve rating scores without proper permissions.

Classification
Writeup 99%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Concrete CMS 9.5.0 and earlier
No auth needed
Prerequisites: Access to the vulnerable endpoint (/ccm/frontend/conversations/get_rating) · Ability to modify the messageId parameter
mistral-large-3 · analyzed Aug 01, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 5.3
EPSS 0.0019
EPSS Percentile 9.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (3)
Concrete CMS/Concrete CMS 5.0 - 9.5.0
concrete5/concrete5 0 - 9.5.1Packagist
concretecms/concrete_cms < 9.5.1
Published May 21, 2026
Tracked Since May 22, 2026