CVE-2026-6826 Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller
Unauthenticated attackers can view restricted file usage details and page references in Concrete CMS due to missing permission checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6826?
CVE-2026-6826 is a medium-severity missing authorization vulnerability in Concretecms Concrete Cms, published on 21 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.
Weakness: CWE-200
Which versions are affected by CVE-2026-6826?
2 open source packages ship an affected version, including concrete5/concrete5. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
concrete5/concrete5 Packagist | All versions | 9.5.1 |
concrete5/concrete5 Packagist | All versions | 9.5.1 |
Products include Concretecms Concrete Cms.
How do I fix CVE-2026-6826?
Upgrade concrete5/concrete5 to 9.5.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-6826 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6826 exists.
Public exploit code: 1 Metasploit module and 1 Nuclei template.
Other vulnerabilities in Concretecms Concrete Cms
- CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- CVE-2022-21829 Code injection in concrete CMS
- CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5
- CVE-2021-40098 Path traversal in n/a
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
Sources
Also known as GHSA-4g7q-44qp-cc5c.