CVE-2026-81908 Concrete CMS CVE debrief

Who should care

Defenders and administrators of Concrete CMS installations, especially those with sensitive group structures or access hierarchies, should assess exposure and prioritize mitigation.

Why it matters

CVE-2026-81908 is a missing authorization vulnerability in Concrete CMS versions 9.2.0 to 9.5.2 that allows authenticated users to retrieve all groups on the site, potentially disclosing sensitive information about the organization's group structure and access hierarchy. Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where group structure and access hierarchy are sensitive.

• Potential disclosure of organization's group structure and access hierarchy.
• Bypass of access controls for group information.
• Increased risk of insider threats or unauthorized access.
• Need for verification of Concrete CMS version and configuration.

Technical summary

The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, bypassing per-object authorization when returning the group collection. An authenticated user with an API token carrying the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site, regardless of view permissions on those groups.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where group structure and access hierarchy are sensitive.

Recommended defensive actions

• Verify the Concrete CMS version and check if it is within the affected range (9.2.0 to 9.5.2).
• Restrict access to the REST API Groups list endpoint to only authorized users with the groups:read scope.
• Consider implementing additional monitoring and logging to detect potential exploitation attempts.
• Review and update access controls and group structures to minimize potential impact.
• Perform thorough reviews of group structures and access hierarchies to identify potential sensitive information.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was reported by Winston Crooker and assigned a CVSS v4.0 score of 6.0 by the Concrete CMS security team. The NVD entry is currently Deferred. Evidence is limited to the report and the official CVE Program record. Defenders should verify the Concrete CMS version and configuration to assess exposure. Additional monitoring and logging may be necessary to detect potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.