CVE-2026-18122 Concrete CMS CVE debrief

Who should care

Defenders responsible for Concrete CMS instances, particularly those with exposed Express REST API list endpoints, should assess their exposure and prioritize verification and remediation.

Why it matters

Defenders should prioritize verifying exposed Concrete CMS instances and restricting access to the Express REST API list endpoint to prevent enumeration of restricted Express entries and disclosure of sensitive information.

• Enumeration of restricted Express entries
• Disclosure of public identifiers, URLs, labels, dates, and attribute or associated-entry data
• Potential unauthorized access to sensitive information
• Verification of proper authorization checks for Express entry collection endpoint

Technical summary

The Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check, allowing an OAuth token with read scope for an Express entity to enumerate entries that its user context lacked permission to view. This vulnerability affects Concrete CMS versions 9.2.0 to 9.5.2 and could lead to disclosure of sensitive information. Defenders should prioritize verifying exposed Concrete CMS instances and restricting access to the Express REST API list endpoint to prevent enumeration of restricted Express entries.

Defensive priority

Defenders should prioritize verifying exposed Concrete CMS instances and restricting access to the Express REST API list endpoint.

Recommended defensive actions

• Verify exposed Concrete CMS instances and restrict access to the Express REST API list endpoint
• Implement proper authorization checks for the Express entry collection endpoint
• Review and update access controls for OAuth tokens with read scope
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS v4.0 score of 6.0 and vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. The vulnerability was reported by riodrwn. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0. The NVD entry and CVE record provide source-provided CVE metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.