aj2108/cve-2026-8239Security write-up for an IDOR in Concrete CMS exposing conversation ratings through missing authorization on the get_rating endpoint, with root cause, attack scenario, and fix.
CVE-2026-8239 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Concrete CMS 9.5.0 and earlier.The vulnerability exists in the /ccm/frontend/conversations/get_rating endpoint, which allows an attacker to determine whether a conversation message exists and retrieve its rating score by supplying an arbitrary message ID. The endpoint fails to perform proper authorization checks before returning the requested information.
Product: Concrete CMS Affected Versions: 9.5.0 and earlier Fixed Version: 9.5.1 Endpoint: /ccm/frontend/conversations/get_rating Vulnerability Type Category: Insecure Direct Object Reference (IDOR) CWE-862: Missing Authorization
The endpoint accepts a message ID from the client and returns information about that message without verifying whether the requesting user is authorized to access it.
Instead of validating ownership or permissions, the application trusts the user-supplied identifier.
Conceptually:
User supplies messageId ↓ Server locates message ↓ No authorization check ↓ Returns message rating
Because the authorization check is missing, an attacker can enumerate message IDs and obtain information about conversations they should not be able to access.
Suppose the application stores conversation messages with numeric IDs.
A legitimate request may reference:
GET /ccm/frontend/conversations/get_rating?messageId=125
An attacker can simply modify the identifier:
GET /ccm/frontend/conversations/get_rating?messageId=126
If the application responds with the rating score instead of returning 403 Forbidden or 404 Not Found, the attacker can confirm that the message exists and retrieve its rating information.
This is a classic IDOR because only the object identifier changes—no malicious payload or injected commands are required.
An attacker can:
Enumerate valid conversation message IDs. Confirm whether specific messages exist. Retrieve rating scores for messages they are not authorized to access. Gain limited information about private conversations.
The vulnerability primarily impacts confidentiality, as unauthorized users can access information that should be protected.
Metric Score CVSS v3.1 (NVD) 5.3 – Medium CVSS v4.0 (Concrete CMS CNA) 6.3 – Medium
The vendor has not published the actual vulnerable source code. The following example illustrates the vulnerability pattern only.
$messageId = $_GET['messageId'];
$message = $conversationRepository->findMessage($messageId);
// No authorization check return response()->json([ 'rating' => $message->getRating() ]);
The application retrieves the message based solely on the user-supplied ID and immediately returns its rating. It never checks whether the current user is permitted to access that message.
$messageId = $_GET['messageId'];
$message = $conversationRepository->findMessage($messageId);
if (!$authorizationService->canViewMessage($currentUser, $message)) { return response()->json([ 'error' => 'Access denied.' ], 403); }
return response()->json([ 'rating' => $message->getRating() ]);
The corrected implementation validates that the authenticated user has permission to view the requested message before returning its rating. Even if an attacker changes the messageId, the server enforces authorization and rejects unauthorized requests with an HTTP 403 Forbidden response. This prevents IDOR by ensuring users can access only the resources they are permitted to view.
