The vulnerability exists in the listGroups() method of Concrete CMS's REST API (concrete/src/Api/Controller/Groups.php), where a permissions checker callback always returns true. This flaw bypasses per-object authorization enforcement when returning the group collection. Consequently, any authenticated user with the groups:read API scope can call GET /ccm/api/1.0/groups and receive all groups on the site regardless of their view permissions, disclosing sensitive information about group roles and access control.

An attacker with valid API credentials and the groups:read scope can enumerate all groups in the Concrete CMS installation, revealing the internal group structure and roles. This information disclosure could aid in further targeted attacks or privilege escalation attempts. However, the vulnerability does not allow modification or direct compromise of the system beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API token scopes to only those necessary and monitor API usage for suspicious activity. Avoid granting the groups:read scope to untrusted users. Follow vendor updates closely for an official patch.