CVE-2026-8204
CVE-2026-8204 · Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
CVSS 6.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
concrete cms
- Versions
- ≥ 5, ≤ 9.5.0: Affected (git)
No fix published
concrete5/concrete5 Packagist
- Versions
- 8.0
- 8.0.1
- 8.0.2
- 8.0.3
- 8.1.0
- 8.2.0
- 8.2.0RC2
- 8.2.1
- 8.3.0
- 8.3.1
- 8.3.2
- 8.4.0
- 8.4.0RC3
- 8.4.0RC4
- 8.4.1
- 8.4.2
- 8.4.3
- 8.4.4
- 8.4.5
- 8.5.0
- 8.5.0RC1
- 8.5.0RC2
- 8.5.1
- 8.5.10
- 8.5.11
- 8.5.12
- 8.5.13
- 8.5.14
- 8.5.15
- 8.5.16
- 8.5.17
- 8.5.18
- 8.5.19
- 8.5.2
- 8.5.20
- 8.5.21
- 8.5.3
- 8.5.4
- 8.5.5
- 8.5.6
- 8.5.6RC1
- 8.5.7
- 8.5.8
- 8.5.9
- 9.0.0
- 9.0.0RC1
- 9.0.0RC3
- 9.0.0RC4
- 9.0.1
- 9.0.2
- 9.1.0
- 9.1.1
- 9.1.2
- 9.1.3
- 9.2.0
- 9.2.0RC2
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.2.7
- 9.2.8
- 9.2.9
- 9.3.0
- 9.3.1
- 9.3.2
- 9.3.3
- 9.3.4
- 9.3.5
- 9.3.6
- 9.3.7
- 9.3.8
- 9.3.9
- 9.4.0
- 9.4.0RC1
- 9.4.0RC2
- 9.4.1
- 9.4.2
- 9.4.3
- 9.4.4
- 9.4.5
- 9.4.6
- 9.4.7
- 9.4.8
- 9.5.0
- 9.5.0RC1
- 9.5.0RC2
- Affected ranges
- ECOSYSTEM: < 9.5.1
Update to 9.5.1