CVE-2026-18122

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.2.0 through 9.5.2

Description The Express REST API list endpoint fails to perform per-entry view permission checks. An attacker using an OAuth token with read scope for an Express entity can enumerate entries that the user context is not authorized to view. This leads to the disclosure of the public identifier, URL, label, dates, and any attribute or associated-entry data requested through the includes parameter.

Recommendations Update Concrete CMS to a version later than 9.5.2. Restrict the use of the includes parameter in the Express REST API list endpoint to minimize data exposure until the update is applied.