CVE-2026-81908 Concrete CMS CVE debrief

Who should care

Defenders and administrators of Concrete CMS installations, especially those with publicly accessible REST API endpoints, should assess exposure and verify access controls. This includes reviewing user permissions, restricting access to the REST API Groups list endpoint, and monitoring API usage for suspicious activity. Security teams should prioritize verifying and restricting access to this endpoint to prevent disclosure of the organization's group结构, 角色

Why it matters

CVE-2026-81908 is a missing authorization vulnerability in Concrete CMS 9.2.0 to 9.5.2 that allows authenticated users with the groups:read scope to retrieve all groups on the site, regardless of view permissions. Defenders should prioritize verifying and restricting access to the REST API Groups list endpoint.

• Disclosure of organization's group structure, roles, and access hierarchy
• Potential unauthorized access to sensitive group information
• Need for verification of access controls and user permissions
• Possible impact on compliance and regulatory requirements

Technical summary

The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, bypassing per-object authorization. This allows authenticated users with the groups:read scope to retrieve all groups on the site, regardless of view permissions. The issue is specific to Concrete CMS 9.2.0 to 9.5.2 and affects the REST API Groups list endpoint. Defenders should prioritize verifying and restricting access to this endpoint, especially for users with the groups:read scope.

Defensive priority

Defenders should prioritize verifying and restricting access to the REST API Groups list endpoint, especially for users with the groups:read scope.

Recommended defensive actions

• Verify and restrict access to the REST API Groups list endpoint
• Limit the groups:read scope to necessary users
• Monitor API usage for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was reported by Winston Crooker and assigned a CVSS v4.0 score of 6.0 by the Concrete CMS security team. The issue is limited to authenticated users with the groups:read scope. Evidence is based on the official CVE record and NVD detail page. Defenders should verify and restrict access to the REST API Groups list endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.