Information Disclosure Vulnerability in Concrete CMS by Concrete

CVE-2026-8238

What is CVE-2026-8238?

Concrete CMS versions 9.5.0 and earlier are vulnerable to a significant information disclosure flaw, allowing unauthenticated users to access sensitive conversation messages. The '/ccm/frontend/conversations/message_page' endpoint exposes the complete contents of all conversation messages, including those restricted to member-only areas and moderation queues. This issue can lead to unauthorized exposure of file attachments with download URLs, compromising user privacy and data security. It’s crucial for users of affected versions to apply security patches and assess their vulnerability management strategies.

References