CVE Explorer
CVE-2026-7886
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The `AddMessage` and `UpdateMessage` conversation controllers accept user-supplied file attachment IDs and load files directly via `$em->find(File::class, $attachmentID)` without checking per-file permissions (`canViewFile()`). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively by
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://github.com/concretecms/concretecms","defaultStatus":"unaffected","product":"Concrete CMS","repo":"https://github.com/concretecms/concretecms","vendor":"Concrete CMS","versions":[{"lessThanOrEqual":"9.5.0","status":"affected","version":"5.0","versionType":"git"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:3ba90f938267d63ec2cd2c5ef09ff974c609fc169403424c625fdd2276c80d9a · sha256:5dfd98189a8a27ab… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":2.3,"baseSeverity":"LOW","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:3ba90f938267d63ec2cd2c5ef09ff974c609fc169403424c625fdd2276c80d9a · sha256:5dfd98189a8a27ab… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-639","description":"CWE-639 Authorization bypass through User-Controlled key","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:3ba90f938267d63ec2cd2c5ef09ff974c609fc169403424c625fdd2276c80d9a · sha256:5dfd98189a8a27ab… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["release-notes"],"url":"https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3ba90f938267d63ec2cd2c5ef09ff974c609fc169403424c625fdd2276c80d9a · sha256:5dfd98189a8a27ab… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.