Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.5.1 | 9.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability described is an IDOR in the /ccm/frontend/conversations/get_rating endpoint of Concrete CMS. The patched version is 9.5.1. By comparing the git tags for version 9.5.0 and 9.5.1, I identified the security patch commit f22b9dff59454391a50a255a39995bf635deea9e.
Analysis of this commit revealed changes to concrete/controllers/frontend/conversations/get_rating.php. Specifically, the getMessage method within the Concrete\Controller\Frontend\Conversations\GetRating class was modified. A check was added to validate that the message being requested belongs to the current conversation context ($this->getBlockConversation()->getConversationID() != $message->getConversationObject()->getConversationID()).
Prior to this patch, the getMessage function would fetch a message by its ID from the parent View controller without this crucial authorization check. This allowed an unauthenticated user to access rating information for any message by simply providing its ID, as stated in the vulnerability description. Therefore, Concrete\Controller\Frontend\Conversations\GetRating::getMessage is the vulnerable function, as it's the point where the insufficient access control existed.
