Concrete CMS - Information Disclosure (CVE-2026-18110)
Description
Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.
psychologyCrowdSec Analysis
CVE-2026-18110 is a high-severity information disclosure vulnerability in Concrete CMS versions 9.0.0 through 9.5.2. An unauthenticated attacker can exploit the user autocomplete endpoint to enumerate backend accounts, including administrator usernames, email addresses, and internal user IDs, potentially aiding targeted attacks; passwords and session data are not exposed.
CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-18110 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target /ccm/system/panels/page/preview_as_user to obtain the panel’s request parameters, then POST to /ccm/system/user/autocomplete to enumerate user accounts. The autocomplete request uses a search query and may expose user IDs, usernames, and email addresses.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-09-15 |
| Rule Released | 2026-10-24 |