CVE-2026-81908
2026-09-11
18h16 +00:00
18h16 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree node) authorization is enforced when the group collection is returned. An authenticated user whose API token carries the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site regardless of the view permissions on those groups, disclosing the organization's group structure, roles, and access hierarchy. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Missing Authorization The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
