Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure

mediumseverity

6.9CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.

Impact

Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.

Fix

Update to the latest version beyond 9.5.0.

How to confirm it

Send: GET {{BaseURL}}/ccm/system/dialogs/file/usage/1
Positive when: contains "ccm-ui" and "Page ID" and "Handle" and "Location" AND status 200

Run it with nuclei: nuclei -id CVE-2026-6826 -u <target>

The full check

id: CVE-2026-6826

info:
  name: Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure
  author: str4k3r
  severity: medium
  description: |
    Concrete CMS 9.5.0 and below  is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.
  impact: |
    Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.
  remediation: |
    Update to the latest version beyond 9.5.0.
  reference:
    - https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes
    - https://www.concretecms.org/security
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6826
    - https://vulnerability.circl.lu/vuln/cve-2026-6826
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 6.9
    cve-id: CVE-2026-6826
    epss-score: 0.01461
    epss-percentile: 0.73811
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"Concrete CMS"
    fofa-query: app="Concrete-CMS"
  tags: cve,cve2026,concretecms,concrete,disclosure,unauth,idor

http:
  - method: GET
    path:
      - "{{BaseURL}}/ccm/system/dialogs/file/usage/1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ccm-ui'
          - 'Page ID'
          - 'Handle'
          - 'Location'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from