Authorization Bypass in Concrete CMS Denies User Security

CVE-2026-18110

What is CVE-2026-18110?

Concrete CMS versions 9.0.0 through 9.5.2 have a significant vulnerability that allows attackers to bypass authorization checks in the user selector autocomplete endpoint. This issue arises because the endpoint only validates a CSRF-style access token tied to the display options, without authenticating the identity or permissions of the requesting user. As a result, an unauthenticated attacker can leverage an empty search query to enumerate all backend accounts, revealing sensitive information such as user IDs, usernames, and email addresses of administrative accounts, including the super-administrator. It is crucial for administrators using affected versions to implement necessary security measures and update to the latest version to mitigate these risks.

References