Concrete CMS: Insecure Direct Object Reference (CVE-2026-8237)

Concrete CMS versions 9.5.0 and earlier are vulnerable to an Insecure Direct Object Reference (IDOR) flaw (CVE-2026-8237). The vulnerability exists within the '/ccm/frontend/conversations/message_detail' endpoint, which fails to perform authorization checks when retrieving conversation messages based on a user-supplied 'messageId'. An attacker can enumerate valid message IDs to access private content and file attachments. The vulnerability is resolved in Concrete CMS version 9.5.1.

Attack Chain

1. Attacker identifies a target instance of Concrete CMS running an affected version.
2. Attacker interacts with the '/ccm/frontend/conversations/message_detail' endpoint.
3. Attacker discovers the 'messageId' parameter via legitimate observation or enumeration.
4. Attacker modifies the 'messageId' parameter value in an HTTP GET request.
5. The application fetches the corresponding message object without verifying requester authorization.
6. The application returns the private message content and associated attachment download URLs to the unauthorized attacker.

Impact

Successful exploitation results in the unauthorized disclosure of private conversation content and sensitive file attachment URLs from restricted or members-only forum areas.

Recommendation

• Upgrade all instances of Concrete CMS to version 9.5.1 or later to implement required authorization checks for conversation messages.
• Review web server access logs for anomalous, high-frequency requests to the '/ccm/frontend/conversations/message_detail' endpoint originating from unauthenticated sessions.