The vulnerability is an IDOR in the /ccm/frontend/conversations/message_detail endpoint of Concrete CMS 9.5.0 and earlier. An unauthenticated user can request any conversation message ID and receive the full message content. Once accessed, the attacker can also download attached files because the attachment URLs are not protected. Because the endpoint exposes messages from restricted pages, member‑only areas, and moderation queues, the flaw can lead to significant disclosure of confidential communications and sensitive data.

Concrete CMS versions 9.5.0 and all earlier releases are affected. The flaw resides in the frontend conversation module and is present in the default product without any configuration changes. All users running these versions should be aware that any user capable of sending HTTP requests to the affected endpoint could obtain private message contents.

With a CVSS score of 6.3, the flaw carries a moderate severity rating. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. An attacker does not need authentication or elevated privileges; they simply request a valid message identifier. While enumeration requires knowledge of the message ID, automated discovery methods can identify valid IDs. Consequently, the exploitation risk is moderate but could be higher in environments where the CMS allows public access to the conversation module.