CVE-2026-8205: Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks lalalala5678 for reporting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8205?
The severity of CVE-2026-8205 is medium with a CVSS score of 6.3.
How does CVE-2026-8205 affect Concrete CMS?
CVE-2026-8205 affects Concrete CMS versions 9.5.0 and below by allowing authorization bypass in the Calendar Block.
What type of vulnerability is CVE-2026-8205?
CVE-2026-8205 is an authorization bypass vulnerability that can result in restricted event details being disclosed.
How can I protect my site from CVE-2026-8205?
To protect your site from CVE-2026-8205, upgrade to a version of Concrete CMS that is above 9.5.0.
When was CVE-2026-8205 published?
CVE-2026-8205 was published on May 21, 2026.