---
id: CVE-2026-7886
title: "Concrete CMS 9.5.0 and below is vulnerable to\_IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass.\_The `AddMessage` and `UpdateMessage` conversation controllers accept user-supplied file …"
summary: "Concrete CMS 9.5.0 and below is vulnerable to\_IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass.\_The `AddMessage` and `UpdateMessage` conversation controllers accept user-supplied file …"
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: concretecms
product: concrete_cms
affected:
  - concrete_cms < 9.5.1
patched:
  - concrete_cms 9.5.1
published: '2026-05-21'
updated: '2026-07-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-7886'
references:
  - url: >-
      https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
epss: 0.00471
epssPercentile: 0.38062
ingestedAt: '2026-07-23T11:17:33.865Z'
---

## Overview

Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The `AddMessage` and `UpdateMessage` conversation controllers accept user-supplied file attachment IDs and load files directly via `$em->find(File::class, $attachmentID)` without checking per-file permissions (`canViewFile()`). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system.  The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting. if a site truly has private files, the owner should set up a  private storage location https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations  outside of the webroot so that permissions can be checked on view as well. That way, even if a authorized user attaches a file, or otherwise links to it, unauthorized users won't be able to view the file.

## Affected

- `concrete_cms < 9.5.1`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.1`