CVE-2026-6826

The record

Concrete CMS 9.5.0 and below  is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.  Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.

Affected packages

Related vulnerabilities

• CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
• CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
• CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
• CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
• CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-200
• CVE-2026-109259 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory… CWE-200
• CVE-2026-107383 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB… CWE-200
• CVE-2026-106120 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. CWE-200