CVE-2026-8204

Katalog CVE

CVSS 5.3 · Medium EPSS 0,35%

Kerentanan Authorization Bypass Through User-Controlled Key pada concretecms concrete cms. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

Rincian

Terbit di NVD

21 Mei 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes release notes