---
id: CVE-2026-81908
title: >-
  Missing Authorization in Concrete CMS 9.2.0 to 9.5.2  REST API Groups List
  Endpoint Allows Authenticated Users to Enumerate All Groups
summary: >-
  Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in
  the REST API Groups list endpoint. The listGroups() method in
  concrete/src/Api/Controller/Groups.php registers a permissions checker
  callback that unconditional…
severity: medium
cvss: 6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Concrete CMS
product: Concrete CMS
affected:
  - concrete_cms >= 9.2.0 <= 9.5.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T19:22:22.630850Z'
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T19:22:43.122Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81908'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
tags:
  - cve.org
epss: 0.00232
epssPercentile: 0.14372
ingestedAt: '2026-09-14T00:35:28.533Z'
---

## Overview

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree node) authorization is enforced when the group collection is returned. An authenticated user whose API token carries the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site regardless of the view permissions on those groups, disclosing the organization's group structure, roles, and access hierarchy. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

## Affected

- `concrete_cms >= 9.2.0 <= 9.5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.