CVE-2026-6826

MediumCVSS 5.3

Published: 21/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Concrete CMS version 9.5.0 and below is vulnerable to unauthenticated file usage disclosure due to missing permission checks in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of pages referencing that file, including page IDs, handles, and full URLs, even for restricted pages.

Risk Assessment

An attacker can obtain information about the site structure and files, including protected pages, which could aid in further attacks.

Recommendation

Upgrade Concrete CMS to version 9.5.1 or later to fix this vulnerability.

Original NVD description (English source)

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.