CVE-2026-18121

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3

Description An authorization bypass known as Insecure Direct Object Reference (IDOR) exists because the frontend calendar lightbox endpoint '/ccm/calendar/view event/{bID}/{occurrence id}' fails to verify if the requester has permission to view the calendar associated with the requested event. The controller retrieves the event occurrence using a sequential identifier provided by the user without confirming its ownership relative to the referenced block. Consequently, an unauthenticated visitor can provide an arbitrary occurrence id to disclose event metadata, including titles, dates, descriptions, page links, and configured event attributes from restricted calendars.

Recommendations Update to version 9.5.3 or later. As a temporary mitigation, restrict access to the '/ccm/calendar/view event/{bID}/{occurrence id}' endpoint or disable lightbox properties on public calendar blocks.