6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8236

CVE-2026-8236: Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID}

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8236

CVE-2026-8236:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is an Insecure Direct Object Reference (IDOR) combined with a missing authentication gate in Concrete CMS. The endpoint /ccm/system/dialogs/file/usage/{fID} allowed unauthenticated access to file usage data. The provided patch f22b9dff59454391a50a255a39995bf635deea9e addresses this by completely removing the concrete/controllers/dialog/file/usage.php file. This file contained the Concrete\Controller\Dialog\File\Usage controller and its view method, which was responsible for handling requests to the vulnerable endpoint. The view method took a file ID as a parameter and returned information about the file's usage without verifying if the user had the necessary permissions to access this information. The removal of this file is the definitive fix for the vulnerability, as it eliminates the insecure endpoint. Therefore, the Concrete\Controller\Dialog\File\Usage::view function is the vulnerable function.

Vulnerable functions

Concrete\Controller\Dialog\File\Usage::view

concrete/controllers/dialog/file/usage.php

The `view` function within the `Usage` controller was accessible without any authentication checks. An attacker could send a GET request to the endpoint `/ccm/system/dialogs/file/usage/{fID}` with an arbitrary file ID (`fID`) to retrieve internal data about where the file is used on the site, including page IDs, versions, and URL paths. The vulnerability was fixed by removing the entire `usage.php` controller, thereby eliminating the vulnerable endpoint.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.