CVE-2026-18110: Concrete CMS: missing authz leaks all admin accounts

Published September 15, 2026

CISO Take

Concrete CMS 9.0.0 through 9.5.2 exposes an unauthenticated user-selector autocomplete endpoint that lets anyone enumerate every backend account, including the super-admin, with username and email. Nothing in the data indicates this is an AI-native flaw: it is a generic CMS authorization bug (CWE-862) and the AI/ML link is tenuous, so treat it as a web-application exposure rather than an AI system compromise. Exploitation likelihood is modest: EPSS is 0.00267 (top 83th percentile band), there is no public exploit, no Nuclei template, it is not in CISA KEV, and CISA SSVC says TRACK. The disclosed data (user IDs, usernames, emails; no password hashes or sessions) is mainly a stepping stone for targeted phishing, credential stuffing, and password-spraying against admin accounts. Upgrade to the fixed release noted in the 9.5.3 release notes, and in the meantime restrict /ccm/system/user/autocomplete at the WAF or reverse proxy.

Sources:NVDEPSSATLASdocumentation.concretecms.org

What is the risk?

Medium-high for confidentiality only. CVSS v3.1 7.5 (v4.0 8.7) reflects network-reachable, zero-privilege, low-complexity exploitation with high confidentiality impact, but no integrity or availability impact. Real-world risk is limited by the absence of known exploitation, public exploits, or scanner templates. Risk rises if admin accounts lack MFA or use reused passwords, since the enumerated identities directly feed targeted attacks. AI/ML relevance is low and this is classified under the ml_ui category with no identified AI package affected.

How does the attack unfold?

Initial Access

Unauthenticated attacker loads a public page and obtains the anonymously issued selector access token.

AML.T0049

Enumeration

Attacker submits an empty query to the autocomplete endpoint and paginates through all backend accounts.

AML.T0087

Impact

Admin usernames and emails are harvested, enabling targeted phishing and credential attacks against the super-admin.

Initial Access

Unauthenticated attacker loads a public page and obtains the anonymously issued selector access token.

AML.T0049

Enumeration

Attacker submits an empty query to the autocomplete endpoint and paginates through all backend accounts.

AML.T0087

Impact

Admin usernames and emails are harvested, enabling targeted phishing and credential attacks against the super-admin.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

1.6%

chance of exploitation in 30 days

Higher than 76% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Possible

Exploitation: LOW

Sophistication

Trivial

Exploitation Confidence

low

○Nuclei detection template available

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Concrete CMS to the release fixing this issue (see the 9.5.3 release notes). 2) Until patched, block or require authentication for /ccm/system/user/autocomplete at the reverse proxy or WAF. 3) Enforce MFA and strong unique passwords on all admin accounts, and rename or limit use of the super-admin account. 4) Review web logs for repeated unauthenticated requests to the autocomplete endpoint with empty queries and pagination parameters. 5) Monitor for credential-stuffing and spraying attempts against enumerated admin emails and consider alerting admins to phishing risk.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassAPIAML.T0049- Exploit Public-Facing Application AML.T0087- Gather Victim Identity Information

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Risk treatment and response to previously unknown risks

Frequently Asked Questions

What is CVE-2026-18110?

Is CVE-2026-18110 actively exploited?

No confirmed active exploitation of CVE-2026-18110 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-18110?

1) Upgrade Concrete CMS to the release fixing this issue (see the 9.5.3 release notes). 2) Until patched, block or require authentication for /ccm/system/user/autocomplete at the reverse proxy or WAF. 3) Enforce MFA and strong unique passwords on all admin accounts, and rename or limit use of the super-admin account. 4) Review web logs for repeated unauthenticated requests to the autocomplete endpoint with empty queries and pagination parameters. 5) Monitor for credential-stuffing and spraying attempts against enumerated admin emails and consider alerting admins to phishing risk.

What systems are affected by CVE-2026-18110?

This vulnerability affects the following AI/ML architecture patterns: Web-based ML dashboards and portals, CMS-fronted AI product sites.

What is the CVSS score for CVE-2026-18110?

CVE-2026-18110 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 1.59%.

What is the AI security impact?

Affected AI Architectures

Web-based ML dashboards and portalsCMS-fronted AI product sites

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0087Gather Victim Identity Information

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.

Exploitation Scenario

An attacker visits a public Concrete CMS page that renders a user selector, obtains the access token issued to anonymous visitors, and sends an empty search to /ccm/system/user/autocomplete. They paginate through the results to harvest all admin usernames and emails, then launch targeted spearphishing or password spraying against the super-admin. If a weak or reused credential succeeds, the attacker gains CMS admin access to a site that may host an organization's AI product content, enabling content tampering or further pivoting.

Weaknesses (CWE)

CWE-862Missing Authorization CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.