CVE-2026-6826: Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMS (Usage controller file usage disclosure)to a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6826?
The severity of CVE-2026-6826 is classified as medium with a score of 6.9.
What does CVE-2026-6826 vulnerabilities involve?
CVE-2026-6826 involves unauthenticated file usage disclosure due to a missing permission check in the usage controller.
How can I mitigate CVE-2026-6826?
To mitigate CVE-2026-6826, upgrade Concrete CMS to version 9.5.1 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-6826?
CVE-2026-6826 affects all users of Concrete CMS 9.5.0 and below.
What data is exposed by CVE-2026-6826?
CVE-2026-6826 allows an unauthenticated visitor to retrieve a list of pages that reference a specified file.