PT-2026-89654
CVE-2026-18121
·
Published
2026-09-10
·
Updated
2026-09-11
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Concrete CMS versions prior to 9.5.3
Description
An authorization bypass known as Insecure Direct Object Reference (IDOR) exists because the frontend calendar lightbox endpoint '/ccm/calendar/view event/{bID}/{occurrence id}' fails to verify if the requester has permission to view the calendar associated with the requested event. The controller retrieves the event occurrence using a sequential identifier provided by the user without confirming its ownership relative to the referenced block. Consequently, an unauthenticated visitor can provide an arbitrary
occurrence id to disclose event metadata, including titles, dates, descriptions, page links, and configured event attributes from restricted calendars.Recommendations
Update to version 9.5.3 or later.
As a temporary mitigation, restrict access to the '/ccm/calendar/view event/{bID}/{occurrence id}' endpoint or disable lightbox properties on public calendar blocks.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾