Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's… (CVE-2026-18122)
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate entries that its user context lacked permission to view, disclosing each entry's public identifier, URL, label, dates, and any attribute or associated-entry data requested via the includes parameter. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
AI Analysis
Technical Summary
The Express REST API list endpoint in Concrete CMS versions 9.2.0 to 9.5.2 does not enforce per-entry view permission checks, allowing an OAuth token with read scope to enumerate Express entries that the user context should not have access to. This results in unauthorized disclosure of each entry's public identifier, URL, label, dates, and any attribute or associated-entry data requested via the includes parameter. The vulnerability is tracked as CVE-2026-18122 and has a CVSS v4.0 score of 6.0.
Potential Impact
An attacker with an OAuth token possessing read scope for an Express entity can access and enumerate restricted Express entries without proper authorization. This leads to unauthorized disclosure of sensitive information such as public identifiers, URLs, labels, dates, and associated attribute data. However, the vulnerability does not allow modification or deletion of data, nor does it escalate privileges beyond the read scope.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict OAuth token issuance to trusted users and minimize read scope permissions for Express entities to reduce exposure.
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's… (CVE-2026-18122)
Description
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate entries that its user context lacked permission to view, disclosing each entry's public identifier, URL, label, dates, and any attribute or associated-entry data requested via the includes parameter. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Express REST API list endpoint in Concrete CMS versions 9.2.0 to 9.5.2 does not enforce per-entry view permission checks, allowing an OAuth token with read scope to enumerate Express entries that the user context should not have access to. This results in unauthorized disclosure of each entry's public identifier, URL, label, dates, and any attribute or associated-entry data requested via the includes parameter. The vulnerability is tracked as CVE-2026-18122 and has a CVSS v4.0 score of 6.0.
Potential Impact
An attacker with an OAuth token possessing read scope for an Express entity can access and enumerate restricted Express entries without proper authorization. This leads to unauthorized disclosure of sensitive information such as public identifiers, URLs, labels, dates, and associated attribute data. However, the vulnerability does not allow modification or deletion of data, nor does it escalate privileges beyond the read scope.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict OAuth token issuance to trusted users and minimize read scope permissions for Express entities to reduce exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-323h-prp6-6hg9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18122"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6aa47ebc55bf5e2cf58579b9
Added to database: 09/11/2026, 22:20:44 UTC
Last enriched: 09/11/2026, 22:48:48 UTC
Last updated: 09/12/2026, 02:09:46 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.