CVE-2026-7886

Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The `AddMessage` and `UpdateMessage` conversation controllers accept user-supplied file attachment IDs and load files directly via `$em->find(File::class, $attachmentID)` without checking per-file permissions (`canViewFile()`). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system.  The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting. if a site truly has private files, the owner should set up a private storage location https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations outside of the webroot so that permissions can be checked on view as well. That way, even if a authorized user attaches a file, or otherwise links to it, unauthorized users won't be able to view the file.

• CWE-639

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notesRelease Notes

Published

May 21, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78837A SQL injection vulnerability in the ap_form_{id} parameter …7.5
• CVE-2026-78838A reflected cross-site scripting (XSS) vulnerability in the …6.5
• CVE-2026-78839An arbitrary file upload vulnerability in AppNitro MachForm …8.1
• CVE-2026-7884IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 t…5.4
• CVE-2026-78847An issue in gray-matter All versions (verified on 4.0.3) all…9.8
• CVE-2026-78849Cross Site Scripting vulnerability in Netgate pfSense Plus s…5.4
• CVE-2026-78863A vulnerability was found in liketrek TREK up to 3.0.22. Imp…6.3
• CVE-2026-78864A vulnerability was determined in liketrek TREK up to 3.0.22…6.3
• CVE-2026-7887For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Co…6.4
• CVE-2026-7888Concrete CMS below 9.5.3 is vulnerable to PHP Object Injecti…8.4
• CVE-2026-78885A vulnerability was identified in liketrek TREK up to 3.0.22…5.6
• CVE-2026-78886A security flaw has been discovered in liketrek TREK up to 3…3.7