CVE-2026-6826
Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.
| CWE | CWE-200 |
| Vendor | concrete cms |
| Product | concrete cms |
| Published | May 21, 2026 |
| Last Updated | May 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for concrete cms concrete cms
Be the first to know when new unknown vulnerabilities affecting concrete cms concrete cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Concrete CMS / Concrete CMS
5.0 ≤ 9.5.0
References
Credits
🔍 Eldudarino Trinsec