The vulnerability is an authorization bypass in Concrete CMS’s Calendar Block caused by the action_get_events method not verifying canView permissions. This flaw allows unauthorized users to retrieve event information that is meant to be restricted, potentially exposing sensitive scheduling data. The weakness is classified as CWE‑425, reflecting a trust boundary breach that undermines confidentiality.

All Concrete CMS releases 9.5.0 and earlier are affected. No specific sub‑version range is listed, meaning every edition of the 9.5.x series down to the initial 9.5.0 release is vulnerable.

The CVSS score of 6.3 indicates a moderate severity, while the EPSS score is not available, so the exact exploitation probability is unknown. Because the CVSS vector shows the attack is network‑based, an attacker can trigger the flaw by accessing the web interface without special privileges. The vulnerability is not currently listed in CISA’s KEV catalog, suggesting no known active exploits, but the low‑to‑moderate risk warrants attention.