Authorization Bypass in Concrete CMS Denies User Security
CVE-2026-18110

8.7HIGH

Key Information:

Vendor

Concrete Cms

Status
Concrete Cms
Vendor
CVE Published:
15 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18110?

Concrete CMS versions 9.0.0 through 9.5.2 have a significant vulnerability that allows attackers to bypass authorization checks in the user selector autocomplete endpoint. This issue arises because the endpoint only validates a CSRF-style access token tied to the display options, without authenticating the identity or permissions of the requesting user. As a result, an unauthenticated attacker can leverage an empty search query to enumerate all backend accounts, revealing sensitive information such as user IDs, usernames, and email addresses of administrative accounts, including the super-administrator. It is crucial for administrators using affected versions to implement necessary security measures and update to the latest version to mitigate these risks.

Affected Version(s)

Concrete CMS 9.0.0 <= 9.5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18110-PoC
Created by flenz00

References

https://documentation.concretecms.org/developers/introduc...
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

thirtythree
.