Concrete CMS IDOR Vulnerability in Conversation Rating Endpoint

Concrete CMS versions 9.5.0 and earlier are affected by an Insecure Direct Object Reference (IDOR) vulnerability, tracked as CVE-2026-8239. The vulnerability exists within the '/ccm/frontend/conversations/get_rating' endpoint. This endpoint accepts a 'message_id' parameter via a GET request and returns the rating score of the corresponding message. Crucially, the application fails to perform any authorization checks to verify if the requester has permission to access the requested message object.

By supplying sequential or arbitrary numeric identifiers in the 'message_id' parameter, an unauthenticated attacker can determine the existence of private messages and retrieve their associated rating scores. This information disclosure flaw allows for the enumeration of messages within the system. The issue is remediated in Concrete CMS version 9.5.1, which introduces authorization checks to ensure users can only access information for which they have explicit permissions.

Impact

Successful exploitation allows unauthenticated attackers to conduct reconnaissance on system messaging activity. By iterating through message IDs, an attacker can confirm the existence of private conversations and extract rating data, leading to the exposure of information that should otherwise be restricted. While the impact is limited to metadata (ratings) and existence confirmation, it poses a privacy risk in environments where message interactions are intended to be confidential.

Recommendation

Prioritize the upgrade of all instances of Concrete CMS to version 9.5.1 or later to remediate CVE-2026-8239. For defenders, monitor web server logs for high-frequency or anomalous access to the '/ccm/frontend/conversations/get_rating' endpoint, particularly those involving sequential or rapid incrementation of the 'messageId' or 'message_id' query parameters.