CVE-2026-7879

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7879", "assignerOrgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "state": "PUBLISHED", "assignerShortName": "ConcreteCMS", "dateReserved": "2026-05-05T18:01:25.067Z", "datePublished": "2026-05-21T21:07:58.943Z", "dateUpdated": "2026-05-22T13:15:14.670Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "shortName": "ConcreteCMS", "dateUpdated": "2026-05-21T21:07:58.943Z"}, "title": "Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Concrete CMS", "product": "Concrete CMS", "collectionURL": "https://github.com/concretecms/concretecms", "repo": "https://github.com/concretecms/concretecms", "versions": [{"status": "affected", "version": "5.0", "lessThanOrEqual": "9.5.0", "versionType": "git"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Concrete CMS 9.5.0 and below,\u00a0 the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading\npermission-restricted files bypasses the view_file permission check.\u00a0Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector\u00a0CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N.\u00a0 Thanks\u00a0Youssef Eid for reporting", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In Concrete CMS 9.5.0 and below,&nbsp; the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading\npermission-restricted files bypasses the view_file permission check.&nbsp;<div>Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file.&nbsp;The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector&nbsp;CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N.&nbsp; Thanks&nbsp;Youssef Eid for reporting</div>"}]}], "references": [{"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Youssef Eid", "type": "finder"}], "source": {"defect": ["HackerOne"], "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-22T13:15:08.207011Z", "id": "CVE-2026-7879", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T13:15:14.670Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7879", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T13:15:08.207011Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T13:15:11.192Z"}}], "cna": {"title": "Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()", "source": {"defect": ["HackerOne"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Youssef Eid"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/concretecms/concretecms", "vendor": "Concrete CMS", "product": "Concrete CMS", "versions": [{"status": "affected", "version": "5.0", "versionType": "git", "lessThanOrEqual": "9.5.0"}], "collectionURL": "https://github.com/concretecms/concretecms", "defaultStatus": "unaffected"}], "references": [{"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "In Concrete CMS 9.5.0 and below,\u00a0 the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading\npermission-restricted files bypasses the view_file permission check.\u00a0Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector\u00a0CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N.\u00a0 Thanks\u00a0Youssef Eid for reporting", "supportingMedia": [{"type": "text/html", "value": "In Concrete CMS 9.5.0 and below,&nbsp; the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading\npermission-restricted files bypasses the view_file permission check.&nbsp;<div>Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file.&nbsp;The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector&nbsp;CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N.&nbsp; Thanks&nbsp;Youssef Eid for reporting</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862"}]}], "providerMetadata": {"orgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "shortName": "ConcreteCMS", "dateUpdated": "2026-05-21T21:07:58.943Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7879", "state": "PUBLISHED", "dateUpdated": "2026-05-22T13:15:14.670Z", "dateReserved": "2026-05-05T18:01:25.067Z", "assignerOrgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "datePublished": "2026-05-21T21:07:58.943Z", "assignerShortName": "ConcreteCMS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/concretecms/concretecms", "defaultStatus": "unaffected", "product": "Concrete CMS", "repo": "https://github.com/concretecms/concretecms", "vendor": "Concrete CMS", "versions": [{"lessThanOrEqual": "9.5.0", "status": "affected", "version": "5.0", "versionType": "git"}]}], "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E0D5AA2-E073-464B-9026-9A428B24ABFA", "versionEndExcluding": "9.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Concrete CMS 9.5.0 and below,\u00a0 the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading\npermission-restricted files bypasses the view_file permission check.\u00a0Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector\u00a0CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N.\u00a0 Thanks\u00a0Youssef Eid for reporting"}, {"lang": "es", "value": "En Concrete CMS 9.5.0 y versiones anteriores, el m\u00e9todo submit_password() en concrete/controllers/single_page/download_file.PHP permite el acceso no autorizado a archivos, ya que la descarga de archivos con restricciones de permiso omite la verificaci\u00f3n de permiso view_file. Los archivos sin contrase\u00f1a se pueden descargar y cualquier usuario que conozca la contrase\u00f1a de un archivo puede descargar un archivo protegido con contrase\u00f1a independientemente de si tiene permiso para acceder al archivo. El equipo de seguridad de Concrete CMS otorg\u00f3 a esta vulnerabilidad una puntuaci\u00f3n CVSS v.4.0 de 6.3 con el vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Gracias a Youssef Eid por el informe."}], "id": "CVE-2026-7879", "lastModified": "2026-07-23T16:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7879", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-22T13:15:08.207011Z", "version": "2.0.3"}}]}, "published": "2026-05-21T22:16:48.777", "references": [{"source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "tags": ["Release Notes"], "url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes"}], "sourceIdentifier": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.0,9.5.0]"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "Concrete CMS", "source": "cna", "vendor": "Concrete CMS"}, "product": "concrete_cms", "vendor": "concretecms"}], "created": "2026-05-21T22:30:20.374529+00:00", "updated": "2026-05-21T23:00:14.158893+00:00", "vendors": ["concretecms", "concretecms$PRODUCT$concrete_cms"]}