CVE-2026-18110

Concrete CMS 9.0.0 through 9.5.2 omits an authorization check on the /ccm/system/user/autocomplete endpoint that backs the 'Preview as User' panel and other user-selector components. The endpoint validates only a token bound to the selector's display options rather than the caller's identity or permissions, and that token is issued to anonymous visitors, so no login is required to query it. Because an empty search query resolves to a match-all filter, an unauthenticated attacker can submit an empty query and paginate through the results to enumerate every backend account, disclosing internal user IDs, usernames, and email addresses — including the super-administrator (user ID 1). No password hashes or session material are exposed, but the full account list enables targeted phishing, password spraying, and credential stuffing against administrative email addresses. The Concrete CMS security team rated it CVSS v4.0 8.7 (high, CWE-862); no public PoC exists and no exploitation has been reported.

What to do: Upgrade to the latest Concrete CMS 9 release containing the fix (any version newer than 9.5.2). Until patched, restrict or block unauthenticated requests to /ccm/system/user/autocomplete at the WAF or reverse proxy, and review access logs for anonymous empty-query calls to that path as evidence of enumeration. Enable MFA and review administrative accounts for non-default usernames, since super-admin email addresses and usernames are trivially disclosed.