Concrete CMS versions 9.5.0 and below have an insecure direct object reference vulnerability in the Express Entry Detail block; the exEntryID parameter can be manipulated to access any Express form submission. The flaw gives attackers the ability to read sensitive user‑supplied data, compromising confidentiality, but does not alter application logic or provide execution capabilities. The CVSS v4 score of 6.3 indicates moderate severity.

Concrete CMS 9.5.0 and earlier versions are affected. No further granularity on patch levels is provided in the advisory.

The vulnerability is reachable through the web interface, using the exEntryID query string. Attackers can exploit it remotely, given that the parameter is publicly exposed. The EPSS score is not available, so the current exploitation probability is unknown. The issue is not listed in the CISA KEV catalog. The moderate CVSS score and lack of exploitable proof suggest a realistic but not imminent risk if exposed to the public web.