CVE-2026-8240: Concrete CMS is vulnerable to unauthenticated page metadata disclosure

May 22, 2026 (updated June 24, 2026)

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the existence of private, draft, and restricted pages while leaking title, path, description, and author information.

References

documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes
github.com/advisories/GHSA-vpgr-cwfx-pwfw
nvd.nist.gov/vuln/detail/CVE-2026-8240

Code Behaviors & Features

Detect and mitigate CVE-2026-8240 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →