CyberRota Analysis
AI-GeneratedConcrete CMS versions 9.0.0 through 9.5.2 are vulnerable due to a lack of authorization checks on the user selector autocomplete endpoint, allowing unauthenticated attackers to enumerate all backend accounts, including administrative users. This vulnerability can lead to the exposure of sensitive user information, such as usernames and email addresses, posing a significant risk to the integrity of the system. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and data exposure.
Original NVD Description
Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.