Concrete CMS versions 9.5.0 and earlier allow an unauthenticated web user to request the file usage endpoint with any file identifier. The missing permission check exposes a list of every page that references that file, including page IDs, handles, and full URLs, even if those pages are normally restricted. This disclosure enables attackers to map application content and identify potentially sensitive or privileged pages, compromising confidentiality without granting direct code execution.

Concrete CMS 9.5.0 and all prior releases are affected.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. No EPSS score is available and the issue is not listed in CISA KEV. Because the attack vector is a simple unauthenticated HTTP request to the /ccm/system/dialogs/file/usage endpoint with a file ID, exploitation requires no additional credentials or complex conditions. An attacker can probe file IDs to enumerate all references, posing a moderate risk of leaking internal URLs and potentially exposing restricted content.