CVE-2026-8205
- Source
- https://cve.org/CVERecord?id=CVE-2026-8205
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8205.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-8205
- Aliases
- Published
- 2026-05-21T20:57:49.858Z
- Modified
- 2026-07-15T01:49:10.771044330Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar
- Details
-
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks lalalala5678 for reporting.
- Database specific
{ "cwe_ids": [ "CWE-425" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8205.json", "cna_assigner": "ConcreteCMS" }- References
Affected packages
Git / github.com/concretecms/concretecms
Affected ranges
- Type
- GIT
- Repo
- https://github.com/concretecms/concretecms
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Database specific
{ "cpe": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "5.0" }, { "last_affected": "9.5.0" }, { "introduced": "0" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE" ] }