PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8239 Concrete CMS CVE debrief

CVE-2026-8239 is a medium-severity insecure direct object reference in Concrete CMS 9.5.0 and below. The affected endpoint can reveal whether a message exists and return its rating score when accessed by message ID, indicating missing authorization checks on a network-reachable path.

Vendor
Concrete CMS
Product
Unknown
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-05-21
Advisory published
2026-05-21
Advisory updated
2026-05-21

Who should care

Concrete CMS site owners, administrators, and developers running version 9.5.0 or earlier, especially teams exposing or integrating the frontend conversations feature.

Technical summary

The NVD record classifies this issue as CWE-862 (Missing Authorization) with CVSS v4.0 6.3. According to the supplied description, the '/ccm/frontend/conversations/get_rating' endpoint confirms the existence of a message and returns its rating score for a given message ID, without the access control expected for a protected object lookup.

Defensive priority

Medium. This is remotely reachable and requires no privileges or user interaction, so it should be prioritized for remediation on any exposed Concrete CMS deployment, especially where message metadata should remain private.

Recommended defensive actions

  • Review the official Concrete CMS release notes linked in the NVD record and update to a vendor-remediated version once identified.
  • Audit access control on '/ccm/frontend/conversations/get_rating' and any related message-ID lookup paths to ensure object-level authorization is enforced.
  • Restrict exposure of frontend conversation endpoints where practical, especially to unauthenticated users or unnecessary network paths.
  • Monitor logs for repeated or unusual requests to message-ID-based endpoints that may indicate enumeration of conversation objects.
  • If custom extensions or integrations depend on this endpoint, verify they do not assume message visibility without explicit authorization checks.

Evidence notes

The source corpus includes an NVD record for CVE-2026-8239 stating that Concrete CMS 9.5.0 and below are vulnerable to IDOR at '/ccm/frontend/conversations/get_rating'. The record provides CVSS v4.0 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) and CWE-862. The only cited vendor reference in the supplied data is Concrete CMS 9.5.1 release notes; no additional remediation details were provided in the corpus.

Official resources

The record was publicly published by NVD on 2026-05-21 and credits Tristan Madani for reporting the issue. No KEV entry is listed in the supplied data.