CVE-2026-8204: Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog

May 21, 2026 (updated June 24, 2026)

Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data.

References

documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes
github.com/advisories/GHSA-x2fp-hj8c-mmxh
nvd.nist.gov/vuln/detail/CVE-2026-8204

Code Behaviors & Features

Detect and mitigate CVE-2026-8204 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →