CVE-2026-8204: Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog
Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8204?
CVE-2026-8204 has a medium severity rating of 6.3.
What vulnerability does CVE-2026-8204 address?
CVE-2026-8204 addresses an authorization bypass vulnerability in Concrete CMS 9.5.0 and below.
How can I fix CVE-2026-8204?
To fix CVE-2026-8204, upgrade to Concrete CMS version 9.5.1 or later.
What kind of impact does CVE-2026-8204 have?
CVE-2026-8204 can lead to cross-calendar data disclosure due to unauthorized access to private calendar data.
Which software is affected by CVE-2026-8204?
CVE-2026-8204 affects Concrete CMS versions 9.5.0 and below.