CVE-2026-18121 in Concrete CMS
Summary
by MITRE • 09/11/2026
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endpoint (/ccm/calendar/view_event/{bID}/{occurrence_id}) does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the occurrence directly from an attacker‑supplied, sequential identifier without confirming that it belongs to the calendar configured on the referenced block. An unauthenticated visitor who can render any public calendar block with lightbox properties enabled could therefore supply an arbitrary occurrence identifier and disclose event metadata — title, date, description, page link, and configured event attributes — from calendars they are not permitted to view. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
Concrete CMS versions 9.5.2 and earlier contain a critical authorization bypass vulnerability within the frontend calendar lightbox endpoint, specifically located at /ccm/calendar/view_event/{bID}/{occurrence_id}. This flaw represents an instance of Insecure Direct Object Reference (IDOR), classified under CWE-639 in industry standards for software security weaknesses. The core technical failure lies in the application logic handling event retrieval requests, where the controller loads calendar occurrence data directly from attacker-supplied sequential identifiers without performing adequate access control checks to verify that the caller is permitted to view the specific calendar owning the requested event. This architectural oversight allows any user who can render a public calendar block with lightbox properties enabled to manipulate the occurrence_id parameter and retrieve metadata associated with events in calendars they are not authorized to access, effectively bypassing intended privacy restrictions through simple identifier enumeration or guessing.
The operational impact of this vulnerability is significant for organizations relying on Concrete CMS for internal communications, event management, or restricted community interactions where certain calendar entries contain sensitive information such as private meeting schedules, confidential project milestones, or personal details of attendees. An unauthenticated attacker can exploit this flaw to disclose a wide range of event metadata including titles, dates, descriptions, page links, and configured custom attributes associated with events in non-public calendars. This unauthorized disclosure compromises the confidentiality integrity of the application by exposing data that was intended to be restricted to specific user groups or administrative roles only. The vulnerability requires no authentication privileges for exploitation as it targets a public-facing endpoint, making it particularly dangerous against web applications where calendar functionality is exposed to general visitors while containing backend-sensitive information within its structure.
From an offensive security perspective, this vulnerability aligns with the ATT&CK technique T1078 Valid Accounts when considering scenarios where authenticated users might exploit similar logic flaws across different endpoints, though in this specific case it affects unauthenticated access due to the public nature of the calendar block rendering. The exploitation vector is straightforward and does not require complex payload construction or user interaction beyond clicking a manipulated link or sending an automated request with altered parameters. Security researchers have identified that because the occurrence identifiers are often sequential or predictable, attackers can easily iterate through potential IDs to harvest large volumes of restricted data in a short period. This automation capability amplifies the risk significantly compared to manual exploitation methods.
To mitigate this vulnerability, administrators must upgrade Concrete CMS to version 9.5.3 or later where the security team has implemented proper authorization checks within the calendar event viewing logic. Until an upgrade is feasible, temporary mitigations include disabling lightbox functionality for public-facing calendar blocks if possible, restricting access to pages containing these calendars through web application firewall rules that monitor for anomalous patterns in occurrence_id parameters, or implementing custom code patches that enforce strict ownership verification before returning any event data. Organizations should also conduct a thorough audit of their calendar configurations to ensure no sensitive information is stored in public-facing events and review server logs for signs of enumeration attacks targeting the affected endpoint. The vulnerability has been assigned a CVSS v4.0 score of 6.3 reflecting its medium severity due to network accessibility, low complexity, and lack of required privileges despite resulting only in limited confidentiality impact without affecting integrity or availability.