CVE-2026-18110: Concrete CMS Information Disclosure Flaw

CVE-2026-18110 Overview

CVE-2026-18110 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions 9.0.0 through 9.5.2. The flaw resides in the user selector autocomplete endpoint at /ccm/system/user/autocomplete, which supports the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token bound to the selector's display options, not to the caller's identity or permissions. Because the selector renders for anonymous visitors, that token is issued without authentication. An unauthenticated attacker can submit an empty query and paginate results to enumerate every backend account, including the super-administrator (user ID 1).

Critical Impact

Unauthenticated attackers can enumerate all backend users and disclose internal user IDs, usernames, and email addresses of every administrative account.

Affected Products

• Concrete CMS 9.0.0 through 9.5.2
• Fixed in Concrete CMS 9.5.3
• Deployments exposing /ccm/system/user/autocomplete to unauthenticated visitors

Discovery Timeline

• 2026-09-15 - CVE-2026-18110 published to NVD
• 2026-09-16 - Last updated in NVD database
• Reported by thirtythree via YesWeHack

Technical Details for CVE-2026-18110

Vulnerability Analysis

The vulnerability is a missing authorization check on a user-facing autocomplete endpoint. The /ccm/system/user/autocomplete handler backs the "Preview as User" panel and other user-selector UI components in the Concrete CMS dashboard. Rather than validating that the caller holds a permission such as "view users" or an authenticated session with administrative rights, the endpoint enforces only a CSRF-style access token. That token binds to the selector's display options and does not identify the caller.

Because the selector widget renders without an authorization check, anonymous visitors receive a valid token. An empty search string resolves to a match-all filter, so any caller with the token can page through the full user directory. The response discloses internal user ID, username, and email address for every account, including the super-administrator at user ID 1. Password hashes and session material are not exposed, but the disclosed identifiers enable targeted credential stuffing, password spraying, and phishing against known administrators.

Root Cause

The root cause is [CWE-862] Missing Authorization. The endpoint delegates access control to a token that was designed to prevent cross-site request forgery, not to enforce user permissions. Anonymous callers can obtain the token from the public-facing selector and reuse it against the backend API.

Attack Vector

Exploitation requires only network access to the affected Concrete CMS instance. An attacker loads a page that renders the user selector to harvest a valid access token, then issues repeated GET requests to /ccm/system/user/autocomplete with an empty query and incrementing page parameters. Each response returns a batch of user records. No authentication, user interaction, or elevated privileges are required. Refer to the ConcreteCMS Version 9.5.3 Release Notes for the vendor's technical description.

Detection Methods for CVE-2026-18110

Indicators of Compromise

• Repeated unauthenticated GET requests to /ccm/system/user/autocomplete from the same source IP
• Sequential pagination parameters against the autocomplete endpoint with empty or wildcard query strings
• Anonymous sessions accessing user-selector endpoints without a preceding authenticated login event

Detection Strategies

• Parse web server and application logs for requests to /ccm/system/user/autocomplete where the session cookie is absent or unauthenticated
• Alert on high request volumes to the autocomplete endpoint from a single client within a short time window
• Correlate autocomplete access with subsequent failed login attempts against enumerated administrator usernames

Monitoring Recommendations

• Ingest Concrete CMS access logs into a centralized SIEM for retention and correlation
• Track baseline request rates to backend selector endpoints and alert on deviations
• Monitor for outbound email or phishing campaigns referencing recently enumerated administrator addresses

How to Mitigate CVE-2026-18110

Immediate Actions Required

• Upgrade Concrete CMS to version 9.5.3 or later as documented in the vendor release notes
• Audit administrative accounts and rotate credentials that may have been exposed to enumeration
• Enforce multi-factor authentication on all backend user accounts, especially the super-administrator

Patch Information

Concrete CMS resolved the missing authorization in version 9.5.3. The fix adds a permission check on the user selector autocomplete endpoint so that only callers with appropriate rights can enumerate users. See the ConcreteCMS Version 9.5.3 Release Notes for upgrade guidance.

Workarounds

• Restrict access to /ccm/system/user/autocomplete at a reverse proxy or web application firewall, allowing only authenticated administrative sessions
• Block anonymous requests to /ccm/system/user/* paths until the upgrade is applied
• Rate-limit requests to backend selector endpoints to slow bulk enumeration attempts

# Example nginx rule restricting the vulnerable endpoint to internal networks
location = /ccm/system/user/autocomplete {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://concretecms_backend;
}