Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.5.1 | 9.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions that the action_get_events function in the Calendar Block of Concrete CMS is missing an authorization check. By analyzing the commits between the vulnerable version (9.5.0) and the patched version (9.5.1), I identified a security-related commit (f22b9dff59454391a50a255a39995bf635deea9e). This commit contains a change in concrete/blocks/calendar/controller.php that adds a permission check using canViewCalendar within the action_get_events function. This directly addresses the reported vulnerability. The lack of this check allowed unauthorized users to access restricted event details, leading to an information disclosure vulnerability.
