CVE-2026-81908 Details
Description
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree node) authorization is enforced when the group collection is returned. An authenticated user whose API token carries the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site regardless of the view permissions on those groups, disclosing the organization's group structure, roles, and access hierarchy. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
A missing authorization vulnerability has been identified in Concrete CMS versions 9.2.0 through 9.5.2. The issue resides in the REST API Groups list endpoint, specifically within the listGroups() method of the Groups controller. This method registers a permissions checker callback that always returns true, allowing authenticated users with the groups:read scope to access the complete group list via the GET /ccm/api/1.0/groups endpoint. This oversight bypasses per-object authorization, enabling the disclosure of the organization's group structure, roles, and access hierarchy, regardless of individual view permissions on the groups.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes | ConcreteCMS | Broken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | ConcreteCMS |
Affected Products
| Product | Versions |
|---|---|
| Concrete CMS | >= 9.2.0, <= 9.5.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | ConcreteCMS |