---
id: CVE-2026-18110
title: >-
  Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check
  on the user selector autocomplete endpoint (/ccm/system/user/autocomplete),
  which backs the "Preview as User" panel and other user-selector components
summary: >-
  Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check
  on the user selector autocomplete endpoint (/ccm/system/user/autocomplete),
  which backs the "Preview as User" panel and other user-selector components.
  The endp…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: concretecms
product: concrete_cms
affected:
  - 'concrete_cms >= 9.0.0, < 9.5.3'
patched:
  - concrete_cms 9.5.3
published: '2026-09-15'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T18:17:11.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18110'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T17:58:38.418391Z'
scores:
  nvd: 7.5
  cna: 8.7
epss: 0.00267
epssPercentile: 0.1912
ingestedAt: '2026-09-15T17:41:02.860Z'
---

## Overview

Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.

## Affected

- `concrete_cms >= 9.0.0, < 9.5.3`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.3`