CVE-2026-95653: Concrete CMS Information Disclosure Flaw

CVE-2026-95653 Overview

CVE-2026-95653 affects the Concrete CMS Community Store extension in versions before 2.7.8. The extension generates digital product download tokens from order creation timestamps rather than cryptographically secure random values. Unauthenticated attackers can enumerate sequential order and file identifiers to compute valid download tokens. This allows retrieval of digital goods purchased by other customers without authentication. The weakness maps to [CWE-340: Generation of Predictable Numbers or Identifiers].

Critical Impact
Unauthenticated attackers can predict download tokens and exfiltrate any digital product delivered through Community Store, breaking the confidentiality of purchased goods across all customers on the storefront.

Affected Products

Concrete CMS Community Store versions prior to 2.7.8
Concrete CMS Community Store v2.7.7 (confirmed vulnerable in Download.php)
Concrete CMS installations distributing digital downloads through the Community Store package

Discovery Timeline

2026-09-22 - CVE-2026-95653 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95653

Vulnerability Analysis

The Community Store package handles digital product delivery through the Download.php utility. In v2.7.7 the class derives the download token deterministically from the order creation timestamp rather than a secure random value. Because order identifiers and file identifiers increment sequentially, an unauthenticated attacker who knows or can estimate the approximate purchase time of an order can reconstruct the token space with high accuracy.

The result is a network-reachable information disclosure primitive. No authentication, user interaction, or elevated privileges are required. Only the confidentiality of digital goods is affected; integrity and availability of the storefront remain intact. Exposure is proportional to the volume of digital products sold and the sensitivity of those files, which may include licensed software, media, or documents tied to individual customers.

Root Cause

The root cause is insecure token generation. The token used to authorize a digital download is derived from order.oDate (the order creation timestamp) instead of a cryptographically strong random value. Timestamps have low entropy and are guessable within seconds, so the token becomes predictable once the order identifier is known or brute-forced.

Attack Vector

An attacker enumerates order identifiers and associated file identifiers through the download endpoint. For each candidate identifier the attacker generates tokens across a small window of plausible order timestamps. Because valid tokens fall within a narrow, deterministic range, the attacker can request the digital asset directly without ever authenticating to the storefront.

php

// Patch snippet from src/CommunityStore/Order/Order.php (v2.7.8)
// A dedicated random security code column replaces timestamp-derived tokens
/** @ORM\Column(type="string", length=255, nullable=true) */
protected $userAgent;

/** @ORM\Column(type="text", nullable=true) */
protected $oSecurityCode;

/**
 * @ORM\OneToMany(targetEntity="Concrete\\Package\\CommunityStore\\Src\\CommunityStore\\Order\\OrderItem", mappedBy="order",cascade={"persist"}))
 */

Source: GitHub Commit a71138d

Detection Methods for CVE-2026-95653

Indicators of Compromise

Unauthenticated requests to Community Store download endpoints referencing sequential order or file identifiers within a short time window.
Repeated HTTP 200 responses returning digital assets to client IPs with no prior authenticated session or purchase history.
Bursts of Download.php requests iterating token values against the same order identifier.

Detection Strategies

Review web server access logs for enumeration patterns against Community Store download URLs, particularly requests lacking a valid customer session cookie.
Correlate download events with the originating order in the database; alert when the requesting IP or user-agent differs from the purchasing customer.
Deploy Web Application Firewall (WAF) rules that rate-limit and challenge unauthenticated access to digital download endpoints.

Monitoring Recommendations

Ingest Concrete CMS application and web server logs into a centralized analytics platform and retain them for post-incident review.
Baseline normal download volume per order and alert on orders whose download count exceeds the number of purchased items.
Track outbound bandwidth from the storefront to identify bulk digital asset exfiltration.

How to Mitigate CVE-2026-95653

Immediate Actions Required

Upgrade Community Store to version 2.7.8 or later, which introduces the oSecurityCode column and random token generation.
Audit recent download logs for enumeration activity and notify affected customers if their digital purchases were accessed.
Rotate or reissue any digital assets whose confidentiality is critical, since previously issued tokens remain predictable in unpatched installations.

Patch Information

The vendor released the fix in GitHub Release v2.7.8. The change is implemented in commit a71138d, which replaces timestamp-derived tokens with a random per-order security code stored in a new oSecurityCode database column. Additional detail is available in the VulnCheck Advisory for Community Store and in the vulnerable code paths at Download.php line 17 and Download.php line 45.

Workarounds

Restrict access to Download.php behind an authenticated session check enforced by the web server or reverse proxy until patching is possible.
Deploy WAF rules to rate-limit requests to Community Store download endpoints and block sequential identifier enumeration.
Temporarily disable digital product delivery through Community Store if the storefront cannot be upgraded promptly.

bash

# Example nginx rule limiting anonymous access to Community Store downloads
location ~* /packages/community_store/.*/download {
    limit_req zone=downloads burst=5 nodelay;
    if ($cookie_CONCRETE5 = "") { return 403; }
}