CVE-2026-18110

Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.

• CWE-862

• https://documentation.concretecms.org/developers/introduction/version-history/953-release-notesBroken Link

Published

Sep 15, 2026

Last Modified

Sep 22, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18103A flaw was found in dhcp-server. A remote attacker with netw…4.9
• CVE-2026-18106IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…4.3
• CVE-2026-18107A flaw was found in CRIU's handling of restartable sequences…7.8
• CVE-2026-18108Net::SAML2 versions before 0.86 for Perl allow authenticatio…9.8
• CVE-2026-18109The W3 Total Cache plugin for WordPress is vulnerable to Sto…7.2
• CVE-2026-1811A flaw has been found in bolo-blog bolo-solo up to 2.6.4. Th…8.8
• CVE-2026-18111Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-s…8.5
• CVE-2026-18113In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block d…7.5
• CVE-2026-18115Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_u…7.4
• CVE-2026-18116Concrete CMS 8.3.0 to 9.5.2 stored calendar event names with…6.1
• CVE-2026-18117Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS…7.3
• CVE-2026-18119Concrete CMS below 9.5.3 did not sanitize custom style value…9