CVE-2026-8205
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block. The action_get_events function does not check canView on the calendar, resulting in restricted event details being disclosed.
Risk Assessment
An attacker could access details of events that should be hidden, potentially compromising data confidentiality.
Recommendation
Update Concrete CMS to a version above 9.5.0 or apply the available patch.
Original NVD description (English source)
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks lalalala5678 for reporting.