Concrete CMS versions 9.5.0 and earlier contain an IDOR vulnerability that permits an unauthenticated attacker to cast votes in a private survey by submitting a restricted optionID through the public survey’s endpoint. This flaw arises from missing authorization checks on survey option submissions, as reflected in CWE‑565 and CWE‑639. The vulnerability can occur only when both public and private surveys coexist on the same site. The impact is on survey results integrity and privacy, but the CVE description does not indicate that other system data or lateral movement are affected.

Any Concrete CMS site running version 9.5.0 or earlier that hosts both public and private surveys simultaneously is affected. The issue is confined to the survey functionality; other components of Concrete CMS are not impacted.

The CVSS v4.0 score of 6.3 indicates moderate severity. No EPSS score is available, so current exploitation likelihood cannot be quantified; the lack of a KEV listing suggests it is not a known exploited vulnerability. The attack vector is network‑based and unauthenticated, with low complexity and no required privileges, meaning an attacker can easily exploit the flaw when both public and private surveys coexist. The impact is limited to survey results integrity and privacy, potentially undermining trust and decision‑making. While the risk is moderate, organizations should patch promptly.