CVE-2026-18110: Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username
Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Concrete CMS 9 installations from 9.0.0 through 9.5.2 are affected. The vulnerable endpoint is reachable without authentication, so exposure does not depend on an attacker having a CMS account.
What does an attacker need to enumerate users?
An attacker needs only network access to the autocomplete endpoint and a CSRF-style token issued when the user selector renders. That token is available to anonymous visitors because the selector is rendered without an authorization check; an empty search can then be paginated to retrieve the directory.
What information can be obtained?
The endpoint can disclose backend users' internal IDs, usernames, and email addresses, including the super-administrator account with user ID 1. Password hashes and session material are not disclosed.