6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8238

CVE-2026-8238: Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated read of any conversation message

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8238

CVE-2026-8238:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Insecure Direct Object Reference (IDOR) within the Concrete CMS conversations feature. The core issue lies in several controller actions that accept numeric IDs to retrieve and display data objects like conversation messages, ratings, and file attachments. These actions failed to perform authorization checks to ensure the currently authenticated (or unauthenticated) user had the right to access the requested objects.

The primary vulnerable function, Concrete\Controller\Frontend\Conversations\MessagePage::getConversation, allowed an unauthenticated attacker to view the content of any conversation on the system by simply enumerating the conversation ID in the URL. This exposed all messages, including those in restricted or private areas.

Related functions for fetching message details, ratings, and handling file attachments shared the same flaw. An attacker could not only read conversations but also access details of specific messages and potentially attach restricted files to conversations, further exposing sensitive information. The security patch addresses these issues by scoping data retrieval to the current page's context and adding explicit permission checks (canViewCalendar, canViewFile, canViewExpressEntries) before returning any data, thus ensuring users can only access information they are authorized to see.

Vulnerable functions

Concrete\Controller\Frontend\Conversations\MessagePage::getConversation

concrete/controllers/frontend/conversations/message_page.php

The function directly fetched a conversation using `Conversation::getByID()` with an ID from the request, without verifying if the user was authorized to view it. This allowed an unauthenticated attacker to enumerate and access any conversation, including private ones, by iterating through numeric IDs. The fix ensures the conversation is retrieved from the current block's context, implicitly validating access.

Concrete\Controller\Frontend\Conversations\MessageDetail::getMessage

concrete/controllers/frontend/conversations/message_detail.php

This function retrieved a message by its ID without ensuring it belonged to a conversation accessible to the user. An attacker could access arbitrary message details by providing a valid message ID. The patch adds a check to validate that the message's conversation ID matches the one from the current block context.

Concrete\Controller\Frontend\Conversations\GetRating::getMessage

concrete/controllers/frontend/conversations/get_rating.php

Similar to `MessageDetail::getMessage`, this function was vulnerable to an IDOR where an attacker could fetch rating information for any message by its ID. The fix ensures the message is part of the conversation in the current block context before proceeding.

Concrete\Controller\Frontend\Conversations\AddMessage::getAttachments

concrete/controllers/frontend/conversations/add_message.php

This function allowed a user to attach a file to a conversation message using the file's ID. It failed to check if the user had permission to view the specified file, allowing an attacker to expose and attach restricted files. The patch adds a `canViewFile` permission check and switches from using internal IDs to UUIDs.

Concrete\Controller\Frontend\Conversations\UpdateMessage::getAttachments

concrete/controllers/frontend/conversations/update_message.php

This function had the same IDOR vulnerability as `AddMessage::getAttachments`. When updating a message, a user could associate it with a restricted file they did not have permission to access. The fix is identical, adding a `canViewFile` permission check to prevent unauthorized file attachment.

Concrete\Block\ExpressEntryDetail\Controller::action_view_express_entity

concrete/blocks/express_entry_detail/controller.php

The function was vulnerable to an IDOR, fetching an 'Express Entry' directly by its ID without checking if the user had permission to view entries of that type. The patch adds a `canViewExpressEntries` permission check and switches to using a public identifier instead of the direct database ID.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.