CVE-2026-6826 json
Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller
published 2026-05-21 5 mo ago modified 2026-09-10 1 mo ago also GHSA-4g7q-44qp-cc5c , EUVD-2026-31344
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 73%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.
Patch / fix
- packagist concrete5/concrete5 9.5.1
- concretecms concrete_cms 9.5.1
Timeline
- First public exploit (Metasploit auxiliary/scanner/http/concrete_cms_file_usage_disclosure)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/scanner/http/concrete_cms_file_usage_disclosure Concrete CMS Unauthenticated File Usage Disclosure metasploit auxiliary, normal rank, 2026-05-21
- Nuclei template Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | concrete5/concrete5 | <9.5.1 |
9.5.1 |
Affected products
- Concrete CMS Concrete CMS
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
Sources
- CVE List CVE-2026-6826
- GitHub Advisory GHSA-4g7q-44qp-cc5c
- NVD CVE-2026-6826
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.