GitHub Advisoryadvisory · Packagist

GHSA-chfm-cm6h-q5x7 Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block

MEDIUM Published 2026-05-22 Modified 2026-06-24 Official page ↗
Aliases
CVE-2026-7881
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-639
Reviewed
2026-06-24

Affected packages

• Packagist concrete5/concrete5: < 9.5.1 → fixed in 9.5.1

Description

Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions. The Concrete CMS security team thanks Tristan Madani for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-7881 Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References