CVE-2026-81908: Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree node) authorization is enforced when the group collection is returned. An authenticated user whose API token carries the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site regardless of the view permissions on those groups, disclosing the organization's group structure, roles, and access hierarchy. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must have an API token with the groups:read scope. The endpoint is network-accessible and does not require user interaction.
What information can be exposed?
A successful request to GET /ccm/api/1.0/groups can return every group on the site, including groups the caller would not normally be allowed to view. This can disclose the organization’s group structure, roles, and access hierarchy.
Are group-level view permissions effective for this endpoint?
No. In affected versions, the permissions checker for the Groups list endpoint always returns true, so per-object or tree-node authorization is not enforced when the group collection is returned.
What can be done while patching is pending?
Limit or revoke groups:read API token scope for users who do not need to enumerate groups, and restrict access to the REST API endpoint where possible. Review API token holders that have this scope because any such authenticated user can query the endpoint.