Missing Authorization in Concrete CMS REST API Groups Endpoint

CVE-2026-81908

What is CVE-2026-81908?

Concrete CMS versions 9.2.0 to 9.5.2 are susceptible to a missing authorization vulnerability in the REST API's Groups list endpoint. The listGroups() method registers a permissions checker that incorrectly allows access, bypassing necessary authorization checks. An authenticated user with the appropriate API token can exploit this flaw to retrieve all groups on the site, exposing sensitive information about the organization’s user roles and access hierarchy. This vulnerability underlines the importance of implementing robust security measures and permissions validation in API endpoints to prevent unauthorized data access.

References