# CVE-2026-18110: Concrete CMS - Information Disclosure

> Live exploitation tracking for CVE-2026-18110 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-18110

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.7
- **Public exploit available:** Yes
- **Affected products:** Concrete CMS
- **Weaknesses:** CWE-862 (Missing Authorization)
- **Tags:** cms

## Description

Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.

## CrowdSec analysis

[CVE-2026-18110](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-18110) is a high-severity information disclosure vulnerability in Concrete CMS versions 9.0.0 through 9.5.2. An unauthenticated attacker can exploit the user autocomplete endpoint to enumerate backend accounts, including administrator usernames, email addresses, and internal user IDs, potentially aiding targeted attacks; passwords and session data are not exposed.

CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-18110 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/ccm/system/panels/page/preview_as_user` to obtain the panel’s request parameters, then POST to `/ccm/system/user/autocomplete` to enumerate user accounts. The autocomplete request uses a search query and may expose user IDs, usernames, and email addresses.

## Timeline

- 2026-09-15: CVE Published. CVE-2026-18110 is published to NVD.
- 2026-10-24: Rule Released. CrowdSec releases a rule to detect CVE-2026-18110 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/advisories/GHSA-7hmf-f7jv-m4xw
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18110.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-18110) follows observed exploitation activity for CVE-2026-18110. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.