Concrete CMS versions 9.5.0 and earlier allow an attacker who can view any website page to read sensitive metadata from every page that uses the Backend\\SummaryTemplate. The flaw reveals titles, URLs, descriptions, and author names for private, draft, and restricted pages, exposing information that could aid further attacks while it is inferred that data integrity and availability remain unaffected.

The affected product is Concrete CMS 9.5.0 and all earlier releases. Any site running these versions and employing a default or custom summary template configuration is susceptible. Upgrading to newer releases that have removed the vulnerable code path eliminates the issue.

The CVSS v4.0 score of 6.3 indicates moderate severity, driven by the lack of authentication and the potential to expose sensitive editorial information. The EPSS score of <1% indicates an extremely low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation. Attackers can exploit the flaw remotely by simply requesting any page URL, making the attack vector intuitive and accessible.