CVE-2026-7886
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass.
Published May 21, 2026 · updated Jul 23, 2026 · concretecms concrete cms
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The and conversation controllers accept user-supplied file attachment IDs and load files directly via without checking per-file permissions ( ). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting. if a site truly has private files, the owner should set up a private storage location https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations outside of the webroot so that permissions can be checked on view as well. That way, even if a authorized user attaches a file, or otherwise links to it, unauthorized users won't be able to view the file.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 21, 2026 · NIST NVD
Detected
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The and conversation controllers accept user-supplied file attachment IDs and load files directly via without checking per-file permissions ( ). A user who can post in any conversation can reference any file in the CMS file manager by its sequential I
Jul 23, 2026 · NIST NVD
Updated
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The and conversation controllers accept user-supplied file attachment IDs and load files directly via without checking per-file permissions ( ). A user who can post in any conversation can reference any file in the CMS file manager by its sequential I
Affected
- cpe concretecms/concrete cmsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-7886
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-7886
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The and conversation controllers accept user-supplied file attachment IDs and load files directly via
nvd.nist.gov