GHSA-p8p9-5953-h9jw
Suggest an improvement- Source
- https://github.com/advisories/GHSA-p8p9-5953-h9jw
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-p8p9-5953-h9jw/GHSA-p8p9-5953-h9jw.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-p8p9-5953-h9jw
- Aliases
- Published
- 2026-05-22T00:31:16Z
- Modified
- 2026-09-10T03:51:06Z
- Severity
-
- 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage
- Details
-
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The
AddMessageandUpdateMessageconversation controllers accept user-supplied file attachment IDs and load files directly via$em->find(File::class, $attachmentID)without checking per-file permissions (canViewFile()). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system. If a site truly has private files, the owner should set up a private storage location https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations outside of the webroot so that permissions can be checked on view as well. That way, even if an authorized user attaches a file, or otherwise links to it, unauthorized users won't be able to view the file. - Database specific
{ "cwe_ids": [ "CWE-639" ], "github_reviewed": true, "github_reviewed_at": "2026-06-24T18:52:03Z", "nvd_published_at": "2026-05-21T22:16:49Z", "severity": "LOW" }- References
Affected packages
Packagist / concrete5/concrete5
Package
- Name
- concrete5/concrete5
- Purl
- pkg:composer/concrete5/concrete5
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed9.5.1