[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2026-8237":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":25,"cwes":26,"cpes":28,"technologies":30,"references":32,"score":34,"epss_score":35,"epss_percentile":36,"is_kev":37,"cisa_kev_date_added":38,"cisa_kev_due_date":38,"cisa_ssvc":39,"attack_mappings":49,"exploits":80},19134,"CVE-2026-8237","EUVD-2026-31352","Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `\u002Fccm\u002Ffrontend\u002Fconversations\u002Fmessage_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N. Thanks Eldudareeno for reporting.","2026-05-21T22:16:00Z",{"cvss_v3.1":10,"cvss_v4.0":19},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":17,"privilegesRequired":17,"confidentialityImpact":18},"UNCHANGED","3.1",5.3,"NETWORK","MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","NONE","LOW",{"Safety":20,"version":21,"Recovery":20,"baseScore":22,"Automatable":20,"attackVector":14,"baseSeverity":15,"valueDensity":20,"vectorString":23,"exploitMaturity":20,"providerUrgency":20,"userInteraction":17,"attackComplexity":18,"attackRequirements":24,"privilegesRequired":17,"subIntegrityImpact":17,"vulnIntegrityImpact":17,"integrityRequirement":20,"modifiedAttackVector":20,"subAvailabilityImpact":17,"vulnAvailabilityImpact":17,"availabilityRequirement":20,"modifiedUserInteraction":20,"modifiedAttackComplexity":20,"subConfidentialityImpact":17,"vulnConfidentialityImpact":18,"confidentialityRequirement":20,"modifiedAttackRequirements":20,"modifiedPrivilegesRequired":20,"modifiedSubIntegrityImpact":20,"modifiedVulnIntegrityImpact":20,"vulnerabilityResponseEffort":20,"modifiedSubAvailabilityImpact":20,"modifiedVulnAvailabilityImpact":20,"modifiedSubConfidentialityImpact":20,"modifiedVulnConfidentialityImpact":20},"NOT_DEFINED","4.0",6.3,"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X","PRESENT",true,[27],"CWE-862",[29],"cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*",[31],"Concretecms Concrete Cms",[33],"https:\u002F\u002Fdocumentation.concretecms.org\u002F9-x\u002Fdevelopers\u002Fintroduction\u002Fversion-history\u002F951-release-notes",0.52,0.00743,0.54258,false,null,{"timestamp":40,"automatable":41,"tech_impact":42,"exploitation":43,"cisa_decision":44,"cisa_remediation_timeline":48},"2026-05-22T12:30:24.575983Z","yes","partial","none",{"vector":45,"decision":46,"priority":47},"CISAv1\u002FE:N\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-25T11:35:56.806217\u002F","attend","medium","14D",[50,56,65,72],{"name":51,"source":52,"tactics":53,"technique_id":55},"Exploit Public-Facing Application","attack_vector",[54],"initial-access","T1190",{"name":57,"source":58,"cwe_ids":59,"tactics":60,"capec_ids":62,"technique_id":64},"Exploitation for Stealth","capec",[27],[61],"stealth",[63],"CAPEC-665","T1211",{"name":66,"source":58,"cwe_ids":67,"tactics":68,"capec_ids":70,"technique_id":71},"Component Firmware",[27],[69,61],"persistence",[63],"T1542.002",{"name":73,"source":58,"cwe_ids":74,"tactics":75,"capec_ids":78,"technique_id":79},"Modify Authentication Process",[27],[76,77,69],"credential-access","defense-impairment",[63],"T1556",[]]