Concrete CMS versions 9.5.0 and below allow an Insecure Direct Object Reference via the attachments[] parameter in AddMessage and UpdateMessage controllers. The system accepts arbitrary file attachment identifiers and loads the files without verifying the requesting user’s view rights, thereby bypassing the CMS file permission system. Consequently, a user who can post messages in any conversation can reference any file in the file manager by its numeric ID, exposing private files to unauthorized viewers. This weakness (CWE‑639) leads directly to confidential data leakage rather than code execution or denial of service.

The vulnerability affects Concrete CMS 9.5.0 and all prior releases. No specific version patch number is cited in the advisory, but administrators should verify whether recent releases contain the fix.

The CVSS v4.0 score of 2.3 reflects low overall impact, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, indicating that no known exploitation has been observed. The most likely attack vector is a legitimate user posting a message or updating a conversation while supplying a file identifier that points to a protected file. This requires knowledge of the target file’s numeric ID, which is generally only discoverable by authorized users or by inspecting the file manager, thereby limiting the attacker’s ability to target arbitrary users. As a result the risk of widespread exploitation remains low, but the exposure of private content justifies remediation.