CVE-2026-7881CWE-639

Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block

Medium · published May 21, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-21T21:09Z
EPSS history
Timeline
  • 21 MAY 21:09Z
    Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block
    cvelistv5