CVE-2026-18121
Received Received - Intake

Authorization Bypass in Concrete CMS via IDOR Vulnerability

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endpoint (/ccm/calendar/view_event/{bID}/{occurrence_id}) does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the occurrence directly from an attacker‑supplied, sequential identifier without confirming that it belongs to the calendar configured on the referenced block. An unauthenticated visitor who can render any public calendar block with lightbox properties enabled could therefore supply an arbitrary occurrence identifier and disclose event metadata — title, date, description, page link, and configured event attributes — from calendars they are not permitted to view. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-18121
EUVD
EUVD-2026-75885

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS 9.5.2 and below has an authorization bypass vulnerability (IDOR) in the frontend calendar lightbox endpoint. The issue allows unauthenticated users to access event metadata from calendars they shouldn't be able to view by manipulating sequential identifiers in the URL.

Detection Guidance

To detect this vulnerability, check Concrete CMS logs for unauthorized access attempts to the /ccm/calendar/view_event/{bID}/{occurrence_id} endpoint. Look for requests with sequential occurrence IDs that do not match the expected calendar context. No specific commands are provided in the context.

Impact Analysis

An attacker could view event details like titles, dates, descriptions, and links from private calendars by exploiting this flaw. This could lead to unauthorized access to sensitive information if public calendar blocks are present on the site.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, potentially violating GDPR (if personal data is exposed) or HIPAA (if protected health information is involved). Organizations may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade Concrete CMS to a version above 9.5.2 to address the authorization bypass. If immediate upgrade is not possible, restrict access to the /ccm/calendar/view_event endpoint via server configuration or firewall rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18121. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart