Concrete CMS versions 9.5.0 and older allow an attacker who can view any website page to read sensitive metadata from every page that uses the Backend\\SummaryTemplate. The flaw reveals titles, URLs, descriptions, and author names for private, draft, and restricted pages, exposing information that could aid further attacks. This weakness, classified as CWE‑284, grants information disclosure without authentication and does not directly alter data integrity or availability.

The affected product is Concrete CMS 9.5.0 and all earlier releases. Any site running these versions and employing the default summary template engine is susceptible. Upgrading to newer releases that have removed the vulnerable code path eliminates the issue.

The CVSS v4.0 score of 6.3 indicates a moderate severity, driven by the lack of authentication and the potential to expose sensitive editorial information. The EPSS score is not available, so the current predictable exploitation likelihood is uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation. Attackers can exploit the flaw remotely by simply requesting any page URL, making the attack vector intuitive and accessible.