CyberRota Analysis
AI-GeneratedThe Concrete CMS Express REST API in versions 9.2.0 to 9.5.2 is vulnerable due to a missing authorization check, allowing unauthorized users to access restricted Express entries. This flaw can lead to the exposure of sensitive information, including public identifiers and associated data, even when the user lacks permission to view those entries. Organizations using affected versions of Concrete CMS should prioritize patching this vulnerability to mitigate potential data leaks and unauthorized access.
Original NVD Description
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate entries that its user context lacked permission to view, disclosing each entry's public identifier, URL, label, dates, and any attribute or associated-entry data requested via the includes parameter. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.