Concrete CMS bug bounty programs
concretecms.com Updated
Concrete CMS runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 1 pays cash
- Targets in scope
- 15
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Concrete CMS
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Concrete CMS
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
Concrete5
Self-hosted · Disclosure only |
– | – | – | – | No cash | None | – | 5 days promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
-
- Safe harbor
- None
- First response
- 5 days promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
15 targets across all 2 programs, each listed once with the programs that cover it. 14 excluded.
-
Concrete Core software, https://github.com/concretecms/concretecms
Source code
Covered by Self-hosted
-
Express objects and the data model built on them, plus the forms and listings that expose those records
Products and areas
Covered by Sorona
-
Login, registration, password reset and session handling, plus any single sign-on wiring the product supports
Products and areas
Covered by Sorona
-
The block, area and stack editing system, where content one user composes is stored and rendered for everyone else
Products and areas
Covered by Sorona
-
The dashboard in full, covering every panel an administrator or editor reaches and the actions each one performs
Products and areas
Covered by Sorona
-
The file manager and upload path: type validation, storage location, thumbnail generation and the routes that serve files back
Products and areas
Covered by Sorona
-
The job and scheduler system, which runs work on a timer with elevated context
Products and areas
Covered by Sorona
-
The package and add-on installer, including the marketplace connection that fetches and unpacks code onto a running site
Products and areas
Covered by Sorona
-
The program declares the core software in scope and lists github.com/concrete5/concrete5 as an asset that accepts submissions. Everything below sits inside the core product
Products and areas
Covered by Sorona
-
The REST API and its OAuth flow, which scripted consumers authenticate against
Products and areas
Covered by Sorona
-
The theme and template layer, and anywhere a template expression evaluates data an untrusted user supplied
Products and areas
Covered by Sorona
-
The user, group and permission model, including page-level and area-level permissions and the advanced permission mode
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 14
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
3d Party libraries
Self-hosted
-
A permission an administrator granted deliberately, rather than a check the software failed to apply
Sorona
-
CSRF Logout
Self-hosted
-
Default Credentials
Self-hosted
-
Reports missing the required canary word, which the program auto-flags on arrival
Sorona
-
Self DoS capability
Self-hosted
-
Server and deployment configuration, including file permissions and web-server rules the operator chose
Sorona
-
Server configuration issues
Self-hosted
-
Stuff Built by other People using Concrete
Self-hosted
-
The *.concrete5.org, *.concretecms.com and *.concretecms.org website wildcards, which the program places out of scope and routes to [email protected]
Sorona
-
Third-party marketplace add-ons and themes, which are separate packages with their own authors rather than the core software the program names
Sorona
-
Upstream PHP and library defects, unless Concrete's own use of them is what makes the issue reachable
Sorona
-
Vulnerabilities for Concrete (concrete5) marketplace products created by the open source community
Self-hosted
-
Websites using our hosting services which we did not build and continue to maintain
Self-hosted
Recent changes
Reward and scope changes across every Concrete CMS program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Concrete CMS products, from the NVD.
-
CVE-2026-85387 Low
Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivat
-
CVE-2026-18120 Medium
Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier could enumerate that entity's entry search results, disclosing attribute values intended to be restri
-
CVE-2026-87028 Medium
Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an authenticated user holding edit-board-contents permission on a single board instance could submit the id
-
CVE-2026-87031 Low
n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) did not perform a permission check before creating an account. As a result, any valid OAuth token carrying the users:add scope, including a client_credentials token with no associated user context, could create active, validated user accounts,
-
CVE-2026-85386 High
Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the application's own origin. An unauthenticated visitor could therefore store an XML document containing an xml-stylesheet processing instruction tha
-
CVE-2026-85385 High
Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName() returns any non-IANA value unchanged. A stored cross-site scripting payload saved in this field executed in an administrator's browser when they viewed the affected user in the Dashboard, running s
-
CVE-2026-81927 Low
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode (concrete.file_manager.images.svg_sanitization.action = reject), uploaded SVGs were checked only against a small built-in blocklist covering the script element and on* event-handler attribute
-
CVE-2026-81926 Low
Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the dialog as raw HTML, so a crafted page path executed script in the editor's authenticated browser session.
About this page
This page gathers every public program listed under concretecms.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.