2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-7886

CVE-2026-7886: Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter

Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The AddMessage and UpdateMessage conversation controllers accept user-supplied file attachment IDs and load files directly via $em->find(File::class, $attachmentID) without checking per-file permissions (canViewFile()). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting. if a site truly has private files, the owner should set up a private storage location https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations outside of the webroot so that permissions can be checked on view as well. That way, even if a authorized user attaches a file, or otherwise links to it, unauthorized users won't be able to view the file.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-7886

CVE-2026-7886:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Concrete CMS versions 9.5.0 and below, where an Insecure Direct Object Reference (IDOR) allows unauthorized access to files. The core of the issue lies in the AddMessage and UpdateMessage conversation controllers. Specifically, the getAttachments method within these controllers accepted integer-based file IDs from user input and directly fetched the corresponding file objects from the database using $em->find(File::class, $attachmentID). This process lacked a crucial permission check to verify if the user performing the action was authorized to access the specified file.

The patch, identified in commit f22b9dff59454391a50a255a39995bf635deea9e, addresses this vulnerability in two ways. First, it changes the file lookup from using the sequential, guessable integer ID to a non-sequential UUID (fUUID). Second, and more importantly, it introduces a permission check using (new Checker($file))->canViewFile() before the file is attached. This ensures that even if a user provides a valid file identifier, they can only attach files they are permitted to view, effectively closing the IDOR vulnerability.

Vulnerable functions

AddMessage::getAttachments

concrete/controllers/frontend/conversations/add_message.php

The `getAttachments` function in the `AddMessage` controller was vulnerable to an Insecure Direct Object Reference (IDOR). It accepted a user-provided file attachment ID and loaded the file using `$em->find(File::class, $attachmentID)` without verifying if the user had permission to view the file. This allowed a user to attach any file from the CMS file manager to a conversation message by its sequential ID, bypassing file permissions. The patch fixes this by switching to a UUID for file lookup and adding a `canViewFile()` permission check.

UpdateMessage::getAttachments

concrete/controllers/frontend/conversations/update_message.php

Similar to `AddMessage`, the `getAttachments` function in the `UpdateMessage` controller was vulnerable to an IDOR. It allowed updating a message with a file attachment by its ID without proper permission checks. An attacker could reference any file by its ID, bypassing the file permission system. The fix involves using the file's UUID instead of its sequential ID and implementing a `canViewFile()` check to ensure the user has the necessary permissions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.