6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8240

CVE-2026-8240: Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\SummaryTemplate

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the existence of private, draft, and restricted pages while leaking title, path, description, and author information. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8240

CVE-2026-8240:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-8240, allows unauthenticated users to access metadata of pages in Concrete CMS. The analysis of the security patch for version 9.5.1 reveals that the vulnerability was in the render method of the SummaryTemplate controller. This method is responsible for rendering summary templates for different content types, including pages. Before the patch, this method did not perform any permission checks, allowing any user to access it. The patch introduced a call to canViewRenderedSummaryTemplates, which, for pages, checks if the user has permission to view the page using Checker::canViewPage(). The primary vulnerable function is Concrete\Controller\Backend\SummaryTemplate::render because it was the entry point for the information disclosure and lacked the necessary security checks. The function Concrete\Core\Summary\Category\Driver\PageDriver::canViewRenderedSummaryTemplates is also included as it contains the logic of the fix itself.

Vulnerable functions

Concrete\Controller\Backend\SummaryTemplate::render

concrete/controllers/backend/summary_template.php

The 'render' function in the 'SummaryTemplate' controller was missing a permission check before rendering summary templates. This allowed an unauthenticated user to request and view metadata of any page, including private, draft, and restricted pages, by crafting a request to the summary template rendering endpoint. The patch added a call to 'canViewRenderedSummaryTemplates' to ensure the user has the necessary permissions.

Concrete\Core\Summary\Category\Driver\PageDriver::canViewRenderedSummaryTemplates

concrete/src/Summary/Category/Driver/PageDriver.php

This new function was added as part of the fix to check if a user can view a page. The vulnerability existed because the check was not performed at all. This function, while part of the fix, demonstrates the permission check that was missing.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.