CVE-2026-8205 — Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results in restricted event details being — CVE Database · The Intelligence Room