Concrete CMS IDOR Vulnerability in File Usage Dialog Endpoint

An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Concrete CMS versions through 9.5.0. The issue arises from a missing authentication check in the file usage dialog endpoint, which allows unauthenticated users to access internal site structure data by sending a GET request with a specific file ID. This data includes page IDs, versions, and URL paths, potentially exposing information from pages with restricted permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of internal site structure data, including sensitive information from pages with restricted permissions.