CVE-2026-8237

CVE-2026-8237 is an Insecure Direct Object Reference (IDOR) vulnerability caused by missing authorization checks in Concrete CMS 9.5.0 and earlier.The flaw exists in the /ccm/frontend/conversations/message_detail endpoint, which returns the full contents of conversation messages based solely on a user-supplied message identifier. Because the application does not verify whether the requester is authorized to access the specified message, an unauthenticated attacker can enumerate message IDs and retrieve conversation content that should remain private. File attachment download URLs associated with those messages may also be disclosed. The issue is fixed in Concrete CMS 9.5.1.

Affected Software

Vulnerability Type

• Category: Insecure Direct Object Reference (IDOR)


• CWE-862: Missing Authorization

Root Cause

The endpoint retrieves a conversation message using a client-controlled message ID without validating whether the current user has permission to access that specific message.

The vulnerable workflow is conceptually:

User supplies messageId
↓
Server fetches message
↓
No authorization check
↓
Returns full message content

Because ownership or access permissions are never verified, attackers can change the messageId value to access other users' conversation messages.

Attack Scenario

Assume a legitimate request retrieves message 150:

GET /ccm/frontend/conversations/message_detail?messageId=150

An attacker simply changes the identifier:

GET /ccm/frontend/conversations/message_detail?messageId=151

If the server responds with the contents of message 151 instead of denying access, the attacker can continue incrementing IDs to enumerate private conversations and their associated attachments.

Impact

Successful exploitation may allow an attacker to:

• Read private conversation messages.
• Access discussions from restricted or members-only pages.
• View moderation queue messages.
• Obtain file attachment download URLs.
• Enumerate valid conversation message IDs.

The vulnerability primarily impacts confidentiality because sensitive information can be disclosed without authorization.

Severity

Conceptual Vulnerable Code

Note: The vendor has not published the actual vulnerable source code. The following example illustrates the vulnerability pattern only.

$messageId = $_GET['messageId'];

$message = $conversationRepository->find($messageId);

// Missing authorization check
return response()->json([
    'message' => $message->getContent(),
    'attachments' => $message->getAttachments()
]);

Why It Is Vulnerable

The application trusts the user-controlled messageId and returns the requested message without confirming that the requester is authorized to access it.

Corrected Code (Conceptual)

$messageId = $_GET['messageId'];

$message = $conversationRepository->find($messageId);

if (!$authorizationService->canView($currentUser, $message)) {
    return response()->json([
        'error' => 'Access denied'
    ], 403);
}

return response()->json([
    'message' => $message->getContent(),
    'attachments' => $message->getAttachments()
]);

Why This Fix Works

The corrected implementation performs a server-side authorization check before returning any conversation data. Even if an attacker modifies the messageId, the request is denied unless the user has permission to access that specific message. This prevents unauthorized disclosure of conversation contents and attachments.