---
id: CVE-2026-18110
title: >-
  Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check
  on the user selector autocomplete endpoint (/ccm/system/user/autocomplete),
  which backs the "Preview as User" panel and other user-selector components
summary: >-
  Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check
  on the user selector autocomplete endpoint (/ccm/system/user/autocomplete),
  which backs the "Preview as User" panel and other user-selector components.
  The endp…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: concretecms
product: concrete_cms
affected:
  - 'concrete_cms >= 9.0.0, < 9.5.3'
patched:
  - concrete_cms 9.5.3
published: '2026-09-15'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T18:17:11.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18110'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T17:58:38.418391Z'
scores:
  nvd: 7.5
  cna: 8.7
epss: 0.01592
epssPercentile: 0.75549
ingestedAt: '2026-09-15T17:41:02.860Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/flenz00/CVE-2026-18110-PoC'
  nuclei:
    - CVE-2026-18110
  checkedAt: '2026-10-27T17:00:42.504Z'
exploitAvailable: true
---

## Overview

Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.

## Affected

- `concrete_cms >= 9.0.0, < 9.5.3`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.3`