CVE-2026-18110
Received Received - Intake

Authorization Bypass in Concrete CMS User Selector

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: ConcreteCMS

Description
Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-18110
EUVD
EUVD-2026-78830

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms From 9.0.0 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS 9 versions 9.0.0 through 9.5.2 have an authorization flaw in the user selector autocomplete endpoint (/ccm/system/user/autocomplete). This endpoint lacks proper permission checks and allows unauthenticated users to access it. An attacker can exploit this by submitting an empty search query to enumerate all backend accounts, revealing internal user IDs, usernames, and email addresses of administrative users, including the super-administrator.

Detection Guidance

To detect this vulnerability, check if your Concrete CMS instance is running versions 9.0.0 through 9.5.2. Test the affected endpoint by sending a GET request to /ccm/system/user/autocomplete with an empty query parameter. If the response includes user IDs, usernames, or emails without authentication, the system is vulnerable.

Impact Analysis

This vulnerability allows unauthenticated attackers to gather sensitive account information from your Concrete CMS installation. They can obtain usernames and email addresses of all administrators, which could be used for further attacks like phishing or brute force attempts. The impact includes potential unauthorized access to administrative functions if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing personally identifiable information (PII) of administrative users. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Unauthorized disclosure of such data may result in regulatory penalties and loss of trust.

Mitigation Strategies

Immediately update Concrete CMS to a version beyond 9.5.2 where this issue is patched. If an update is not immediately possible, restrict access to the /ccm/system/user/autocomplete endpoint via server-side rules or disable the 'Preview as User' feature until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18110. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart