CVE-2026-18110 is a missing authorization flaw in Concrete CMS 9, versions 9.0.0 through 9.5.2. An anonymous visitor can list every backend account, including usernames and emails of administrators. The record scores it 7.5, High, while the vendor team scored it 8.7 on CVSS 4.0. Upgrade to 9.5.3 or later.
What's affected
Concrete CMS 9.0.0 through 9.5.2, per the record. The project's GitHub release notes list CVE-2026-18110 under Security Updates for Concrete CMS 9.5.3, so 9.5.3 is the first fixed release we could confirm. Later releases, 9.5.4 and 9.5.5, were also available when we reviewed the releases page. Upgrade to the newest 9.5.x release, which also carries other security fixes.
The record's own reference, a version history page for 9.5.3 release notes, returned a not found error when we fetched it. We used the GitHub release notes instead.
What leaks: the record says an unauthenticated attacker can list the internal user ID, username and email address of every backend account, including the super administrator (user ID 1). It says no password hashes or session material are disclosed.
The record scores it 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The sources give two scores. The record has CVSS 3.1 7.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The Concrete CMS security team scored it 8.7 on CVSS 4.0, which appears in the record text and in the 9.5.3 release notes as a risk rank of 8.7. Both are High. We use the record's 7.5 in the title and note 8.7 as the vendor's score.
How to check if you're exposed
Check which Concrete CMS version you run. The Dashboard shows it, and on a Composer-based install you can run composer show and read the version of the Concrete core package.
You can also look for signs in your web server logs. The affected endpoint is the user selector autocomplete path, /ccm/system/user/autocomplete. Many requests to it from visitors who are not signed in, especially paging through results, would be unusual.
grep "/ccm/system/user/autocomplete" access.log | wc -l
A high count from anonymous clients is worth a closer look. A count of zero does not prove nothing happened, since logs rotate, but it is reassuring. Also consider the exposure of the information itself: administrator emails are a target for phishing and password guessing.
What to do now
- Find your Concrete CMS version in the Dashboard or with Composer.
- Upgrade to 9.5.3 or later, preferably the newest 9.5.x release.
- Review web logs for anonymous requests to the user selector autocomplete path, and block abuse at the web application firewall if you see it.
- Treat administrator emails and usernames as known to others. Enforce strong passwords and two-factor authentication for administrators, and rename or remove a default or guessable super administrator username.
- Warn administrators to expect phishing that uses their names and roles.
Why it matters
The record classes the weakness as CWE-862, Missing Authorization. The record classes the weakness as CWE-862, missing authorization. The user selector, which backs the Preview as User panel and other pickers, calls an autocomplete endpoint. That endpoint checked only a CSRF-style token that was tied to the selector's display options, not to who is asking or what they may do. And the token was handed out to anonymous visitors, because the selector rendered without an authorization check.
An empty query matched everything, so a visitor could page through all accounts. The leak is limited: IDs, usernames and emails, not password hashes or sessions, according to the record. That limit is why the score is High and not Critical.
Do not underrate it. Knowing every administrator's username and email removes half of a guessing attack, and gives phishers real names. For small sites, the super administrator's address is also often the account recovery address. The fix belongs to the application, but your side includes strong authentication on admin accounts. This CVE is not in the CISA Known Exploited Vulnerabilities catalog and the record does not report exploitation.
Try it yourself
Release notes with dozens of security fixes are easy to miss. This demo shows continuous monitoring flagging a new advisory against a component you already run, so an upgrade like 9.5.3 gets scheduled early.
Click through it at your own pace, or open it full screen.
Quick check
Are passwords exposed?
The record says no password hashes or session material are disclosed. It does say user IDs, usernames and emails of all backend accounts are.
Why two different scores?
The record has CVSS 3.1 at 7.5. The vendor scored it 8.7 on CVSS 4.0. Both put it in the High range.
Sources
- Concrete CMS 9.5.3 release notes on GitHub, fetched 18 October 2026
- Concrete CMS 9.5.3 version history page (listed in the record), listed in the record but could not be read when fetched
Last reviewed: 18 October 2026.
