← CVE Intelligence

CVE-2026-8204

Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog PUBLISHED

Description (CNA)

Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

Affected (CNA)

Vendor / productVersions
Concrete CMS / Concrete CMSaffected 5 through 9.5.0

CWE

CWE-639

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.