Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-8205: Concrete CMS calendar can expose private event details
CVE-2026-8205 · published 5 months ago
Summary
In Concrete CMS versions up to 9.5.0, the calendar feature does not verify whether a user is allowed to see the calendar before showing event information. As a result, anyone who can reach the calendar page may view details of events that were meant to be restricted. Upgrade to the latest version of Concrete CMS or apply the security patch released by the vendor, and review calendar permissions until the fix is in place.
What to do
- Update concrete5 concrete5 to version 9.5.1.
- Update concrete5 concrete5/concrete5 to version 9.5.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | concretecms | concrete_cms |
<= 9.5.0 cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:* |
| composer | concrete5 | concrete5 |
< 9.5.1 Fix: upgrade to 9.5.1
|
| Packagist | concrete5 | concrete5/concrete5 |
< 9.5.1 Fix: upgrade to 9.5.1
|
Original advisory text
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks lalalala5678 for reporting.
References
- https://documentation.concretecms.org/9-x/developers/introduction/version-histor... Vendor Advisory
- https://github.com/advisories/GHSA-46xh-7854-f568
- https://nvd.nist.gov/vuln/detail/CVE-2026-8205 Vendor Advisory
- https://github.com/concretecms/concretecms Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8205.j... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-425Direct Request ('Forced Browsing')
Timeline
Published21 May 2026
Updated29 Oct 2026
First seen21 May 2026
Sources
CVE-2026-8205 · NVD
GHSA-46xh-7854-f568 · GHSA
GHSA-46xh-7854-f568 · OSV
CVE-2026-8205 · OSV
Track software like this
Free during beta