Concrete CMS versions 9.5.0 and prior allow an unauthenticated actor to discover the existence of any conversation message by ID and read its rating score through the '/ccm/frontend/conversations/get_rating' endpoint. The flaw is a classic indirect object reference (IDOR) that does not provide modification authority, but still leaks potentially sensitive data about user interactions. The underlying weakness corresponds to CWE‑862, Missing Authorization, which permits read‑only exposure of data that should be protected by authentication or role checks.

The issue affects Concrete CMS, specifically all releases up to and including 9.5.0. Users running these versions must verify their installation and apply the vendor’s fix or upgrade to a later version.

With a CVSS score of 6.3, the vulnerability is considered moderate. The endpoint is publicly reachable, so an attacker only needs to supply a message ID to read the rating, making exploitation straightforward once the ID is known. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, but the absence of authentication controls and the straightforward attack surface still pose a tangible risk of data leakage in affected systems.