CVE-2026-81908
Deferred Deferred - Pending Action

Missing Authorization in Concrete CMS REST API

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree node) authorization is enforced when the group collection is returned. An authenticated user whose API token carries the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site regardless of the view permissions on those groups, disclosing the organization's group structure, roles, and access hierarchy. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-81908
EUVD
EUVD-2026-76160

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms From 9.2.0 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS versions 9.2.0 to 9.5.2 have a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that always returns true, so no per-object authorization is enforced when groups are returned. This allows an authenticated user with the groups:read scope to call GET /ccm/api/1.0/groups and receive all groups on the site, even those with restricted view permissions.

Detection Guidance

To detect this vulnerability, check if your Concrete CMS version is between 9.2.0 and 9.5.2. Use the API endpoint GET /ccm/api/1.0/groups with an authenticated user token having the groups:read scope. If the response includes all groups regardless of permissions, the system is vulnerable.

Impact Analysis

This vulnerability allows an attacker to disclose the organization's group structure, roles, and access hierarchy. An authenticated user with the groups:read scope can access sensitive information about group permissions and roles, potentially aiding further attacks or unauthorized access.

Mitigation Strategies

Immediately update Concrete CMS to a version beyond 9.5.2 where this vulnerability is patched. If an update is not immediately possible, restrict API token scopes to limit access and monitor group-related API calls for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81908. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart