IDOR Vulnerability in Concrete CMS Affects File Permissions

CVE-2026-7886

What is CVE-2026-7886?

Concrete CMS versions 9.5.0 and earlier are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability via the AddMessage and UpdateMessage conversation controllers. This vulnerability arises from the use of user-supplied attachment IDs without adequate permission checks. As a result, a user who has the ability to post in any conversation can access any file in the system by referring to it by its sequential ID, circumventing the overall file permission mechanism. To mitigate this issue, it is recommended that site owners implement a private storage location outside of the webroot, ensuring that permissions are enforced correctly on file views.

References