CVE-2026-81908: Concrete CMS Information Disclosure Flaw

CVE-2026-81908 Overview

CVE-2026-81908 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions 9.2.0 through 9.5.2. The flaw resides in the REST API Groups list endpoint exposed at GET /ccm/api/1.0/groups. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true. As a result, no per-object authorization is enforced against tree nodes when the group collection is returned. An authenticated user whose API token carries the groups:read scope receives every group defined on the site, disclosing organizational structure, roles, and access hierarchy.

Critical Impact
Any authenticated API client with the groups:read scope can enumerate the complete group hierarchy of a Concrete CMS site, regardless of per-group view permissions.

Affected Products

Concrete CMS 9.2.0 through 9.5.2
Concrete CMS REST API v1.0 (/ccm/api/1.0/groups)
Deployments issuing API tokens with the groups:read scope

Discovery Timeline

Vulnerability reported by Winston Crooker to the Concrete CMS security team
2026-09-11 - CVE-2026-81908 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in the NVD database

Technical Details for CVE-2026-81908

Vulnerability Analysis

Concrete CMS exposes group management through a REST API controller located at concrete/src/Api/Controller/Groups.php. The listGroups() method returns a collection of group tree nodes. Normally, each tree node in Concrete CMS enforces view permissions so that a caller only sees nodes they are authorized to inspect. In vulnerable versions, listGroups() registers a permissions checker callback that always returns true. The framework therefore treats every group as viewable for the current caller.

The issue is limited to confidentiality. An attacker cannot modify, create, or delete groups through this flaw, and availability is unaffected. However, the leaked data includes group names, hierarchy, and role structure that support subsequent phishing, privilege escalation, or access control mapping attacks.

Root Cause

The root cause is a broken per-object authorization check inside the API controller. The permissions callback bypasses Concrete CMS's tree node permission model. The scope check on the API token (groups:read) is treated as sufficient authorization, conflating authentication scope with fine-grained object-level access control. This matches the [CWE-862] Missing Authorization pattern.

Attack Vector

Exploitation requires network access to the Concrete CMS instance and a valid API token that includes the groups:read scope. No user interaction is required. The attacker issues an HTTP GET request against /ccm/api/1.0/groups with a bearer token. The response returns the full list of groups on the site, including those the token holder should not be able to view under normal ACL enforcement.

See the Concrete CMS 9.5 Release Notes for the vendor's technical description of the fix.

Detection Methods for CVE-2026-81908

Indicators of Compromise

Unexpected GET /ccm/api/1.0/groups requests from API tokens that should not enumerate group hierarchy
API tokens with groups:read scope issued to low-privilege service accounts or integrations
Response payloads for /ccm/api/1.0/groups that are unusually large relative to the calling token's expected visibility

Detection Strategies

Enable request logging on the Concrete CMS web tier and alert on any access to /ccm/api/1.0/groups
Correlate API token identity with the number of groups returned to identify tokens receiving broader data than their role warrants
Review audit logs for issuance of tokens carrying the groups:read scope after the vulnerability disclosure date

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform and baseline normal API call patterns
Alert on bursts of /ccm/api/1.0/groups requests from a single token, IP, or user agent
Track newly created API tokens and enforce approval workflows before granting groups:read

How to Mitigate CVE-2026-81908

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later as described in the vendor release notes
Inventory all active API tokens and revoke any that carry the groups:read scope but do not need it
Rotate API tokens for third-party integrations after applying the patch
Review historical access logs for /ccm/api/1.0/groups to identify prior enumeration

Patch Information

Concrete CMS addressed the missing authorization check in version 9.5.3. The fix corrects the permissions checker callback in listGroups() so that per-object tree node authorization is enforced before groups are included in the response. Details are published in the Concrete CMS 9.5.3 Release Notes.

Workarounds

Restrict access to /ccm/api/1.0/groups at the web server or reverse proxy layer until patching is complete
Remove the groups:read scope from API tokens that do not strictly require group enumeration
Limit API access to trusted source IP ranges through firewall or WAF rules

bash

# Example nginx block restricting the vulnerable endpoint to trusted hosts
location = /ccm/api/1.0/groups {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://concrete_backend;
}