{"id":"CVE-2026-8237","title":"Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message","summary":"Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, incl…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-862"],"vendor":"concretecms","product":"concrete_cms","affected":["concrete_cms < 9.5.1"],"patched":["concrete_cms 9.5.1"],"published":"2026-05-21","updated":"2026-07-23","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8237","references":[{"url":"https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes","label":"ff5b8ace-8b95-4078-9743-eac1ca5451de"}],"tags":["nvd","exploit-available"],"epss":0.0064,"epssPercentile":0.49261,"ingestedAt":"2026-07-23T11:17:33.923Z","exploits":{"github":1,"githubRepos":["https://github.com/aj2108/CVE-2026-8237"],"nuclei":["CVE-2026-8237"],"checkedAt":"2026-09-23T07:14:57.508Z"},"exploitAvailable":true,"slug":"CVE-2026-8237","body":"## Overview\n\nConcrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.\n\n## Affected\n\n- `concrete_cms < 9.5.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `concrete_cms 9.5.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5494,"id":"CVE-2026-8237","ts":1788887294942,"field":"exploit_available","old":"false","new":"true"},{"seq":4372,"id":"CVE-2026-8237","ts":1788886402397,"field":"exploit_available","old":"true","new":"false"},{"seq":3088,"id":"CVE-2026-8237","ts":1788883066538,"field":"exploit_available","old":"false","new":"true"},{"seq":2117,"id":"CVE-2026-8237","ts":1788882470480,"field":"exploit_available","old":"true","new":"false"},{"seq":1182,"id":"CVE-2026-8237","ts":1788881907806,"field":"exploit_available","old":"false","new":"true"}]}