CVE-2026-81908 in Concrete CMS
Summary
by MITRE • 09/11/2026
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree node) authorization is enforced when the group collection is returned. An authenticated user whose API token carries the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site regardless of the view permissions on those groups, disclosing the organization's group structure, roles, and access hierarchy. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2026
Concrete CMS versions ranging from 9.2.0 through 9.5.2 are affected by a critical missing authorization vulnerability within the REST API Groups list endpoint, specifically located in the concrete/src/Api/Controller/Groups.php file. This flaw stems directly from the implementation of the listGroups() method, which is designed to retrieve and return a collection of user groups for authenticated API consumers. The core technical defect lies in the registration of a permissions checker callback that unconditionally returns true regardless of the actual access control policies defined within the CMS environment. By hardcoding this positive response, the application bypasses any per-object or tree node authorization checks that would normally restrict visibility based on individual group settings. This architectural oversight means that the API endpoint fails to validate whether the requesting user has explicit permission to view specific groups before including them in the returned dataset.
The operational impact of this vulnerability is significant for organizations relying on Concrete CMS, as it allows any authenticated user possessing an API token with the groups:read scope to enumerate every group present on the site. This includes sensitive administrative groups, security roles, and internal access hierarchies that are typically restricted from general users or lower-privilege accounts. The disclosure of this structural information provides attackers with a detailed map of the organization's identity management framework. Such intelligence is highly valuable for subsequent attack phases, enabling adversaries to identify high-value targets such as administrative groups or privileged roles, thereby facilitating more precise privilege escalation attempts and lateral movement within the compromised environment.
From a classification perspective, this vulnerability aligns closely with CWE-285 Improper Authorization, where the software does not perform proper authorization checks when accessing resources. It also relates to CWE-639 Injection of Critical Information into Response via Unvalidated Input, as sensitive internal data is exposed through an API response without adequate validation of the requester's entitlements. In terms of offensive security frameworks, this flaw supports reconnaissance activities categorized under MITRE ATT&CK technique T1087 Account Discovery, specifically within cloud or networked environments where group structures reveal organizational hierarchy and role assignments. The ability to map out these relationships effectively lowers the barrier for attackers seeking to understand access controls before launching targeted exploits against specific accounts or services protected by those groups.
The Concrete CMS security team has assessed this vulnerability with a CVSS v4.0 score of 6.0, reflecting its medium severity due to the high confidentiality impact combined with low attack complexity and required privileges. The vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N indicates that while the vulnerability is exploitable over a network with little expertise, it requires low privilege to exploit and results in high confidentiality loss without impacting integrity or availability. Mitigation strategies should prioritize immediate patching to versions of Concrete CMS released after 9.5.2 where this authorization logic has been corrected. In environments where upgrading is not immediately feasible, administrators can implement a Web Application Firewall rule to block access to the /ccm/api/1.0/groups endpoint for users who do not possess explicit administrative privileges or specific group-viewing permissions. Additionally, auditing API token scopes and ensuring that tokens are issued with only the minimum necessary permissions can help limit the blast radius if such an exploit is attempted in unpatched systems.