CVE-2026-8238: Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated read of any conversation message
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/messagepage' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8238?
The severity of CVE-2026-8238 is medium, with a CVSS score of 6.3.
How does CVE-2026-8238 affect Concrete CMS?
CVE-2026-8238 allows unauthenticated users to read any conversation message through the vulnerable endpoint in Concrete CMS.
What versions of Concrete CMS are affected by CVE-2026-8238?
CVE-2026-8238 affects Concrete CMS version 9.5.0 and below.
How can I mitigate the risks associated with CVE-2026-8238?
To mitigate the risks of CVE-2026-8238, upgrade to Concrete CMS version 9.5.1 or later.
Is CVE-2026-8238 an authenticated or unauthenticated vulnerability?
CVE-2026-8238 is an unauthenticated vulnerability, allowing access without user credentials.