CVE-2026-18110 Concrete CMS CVE debrief

Who should care

System administrators and security teams responsible for Concrete CMS installations should assess exposure and apply necessary patches or mitigations to prevent potential exploitation.

Why it matters

CVE-2026-18110 is a high-severity vulnerability in Concrete CMS that allows an unauthenticated attacker to enumerate backend accounts, disclosing sensitive user information. Immediate attention is required to assess exposure and apply mitigations.

• Disclosure of internal user IDs, usernames, and email addresses of administrative users
• Potential for targeted attacks using disclosed user information
• Increased risk of phishing or social engineering attacks
• Need for verification of user account configurations and permissions

Technical summary

The user selector autocomplete endpoint in Concrete CMS versions 9.0.0 through 9.5.2 does not perform an authorization check, allowing an unauthenticated attacker to enumerate backend accounts by submitting an empty search and paginating results. This vulnerability arises from the endpoint's validation of only a CSRF-style access token bound to the selector's display options rather than to the caller's identity or permissions. As a result, an attacker can disclose internal user IDs, usernames, and email addresses of all administrative users, including the super-administrator. No password hashes or session material are disclosed, but the information obtained can be used for targeted attacks or phishing.

Defensive priority

Immediate attention is required to assess exposure and apply mitigations, as an unauthenticated attacker can exploit this vulnerability to disclose sensitive user information.

Recommended defensive actions

• Assess exposure by checking if Concrete CMS versions 9.0.0 through 9.5.2 are in use
• Apply patches or mitigations as recommended by the vendor
• Monitor for potential exploitation attempts
• Verify user account configurations and permissions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows an unauthenticated attacker to submit an empty search and paginate results to enumerate every backend account, disclosing internal user IDs, usernames, and email addresses of all administrative users. No password hashes or session material are disclosed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.