CVE-2026-8204
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Concrete CMS version 9.5.0 and below is vulnerable to authorization bypass in the Calendar Event Frontend Dialog, allowing cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data.
Risk Assessment
The organization is at risk of unauthorized access to private calendar data, potentially leading to leakage of confidential information.
Recommendation
It is recommended to immediately upgrade Concrete CMS to a version newer than 9.5.0 that includes a fix for this vulnerability.
Original NVD description (English source)
Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.