CVE-2026-7886

Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The `AddMessage` and `UpdateMessage` conversation controllers accept user-supplied file attachment IDs and load files directly via `$em->find(File::class, $attachmentID)` without checking per-file permissions (`canViewFile()`). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system.  The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting. if a site truly has private files, the owner should set up a private storage location https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations outside of the webroot so that permissions can be checked on view as well. That way, even if a authorized user attaches a file, or otherwise links to it, unauthorized users won't be able to view the file.

• CWE-639

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notesRelease Notes

Published

May 21, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7874IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow d…9.1
• CVE-2026-7875NanoClaw version 1.2.0 and prior contains a host/container f…9.3
• CVE-2026-7876IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by…9.1
• CVE-2026-7879In Concrete CMS 9.5.0 and below,  the submit_password() meth…5.3
• CVE-2026-7881Concrete CMS 9.5.0 and below is subject to Insecure Direct O…4.3
• CVE-2026-7882Concrete CMS 9.5.0 and below is vulnerable to unauthorized …4.3
• CVE-2026-7887For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Co…6.4
• CVE-2026-7888Concrete CMS below 9.5.2 is vulnerable to PHP Object Injecti…8.4
• CVE-2026-7890In Concrete CMS 9.5.0 and below, the RSS Displayer block acc…6.4
• CVE-2026-7891A vulnerability has been identified in Mendix Runtime (All v…9.1
• CVE-2026-7896Integer overflow in Blink in Google Chrome prior to 148.0.77…8.8
• CVE-2026-7897Use after free in Mobile in Google Chrome on iOS prior to 14…7.5