CVE-2026-6826 Scanner
CVE-2026-6826 Scanner - Information Disclosure vulnerability in Concrete CMS
Used 2.5k times · 5.9k assets checked · url
CVE
CVE-2026-6826
6.9
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
concrete cms
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: concrete cms
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →