Authorization Flaw in Concrete CMS Affects Multiple Boards

CVE-2026-18421

What is CVE-2026-18421?

Concrete CMS versions 9 through 9.5.2 are susceptible to an authorization vulnerability that allows attackers to manipulate or delete configured data sources across different boards. The flaw exists due to a lack of proper permissions verification in critical actions, permitting a user with editing permissions on a single board to inadvertently affect other boards' configurations. This vulnerability exploits the CSRF token validation mechanism, which checks tokens based on action names but fails to link them to their respective target objects, enabling unauthorized access to modify or delete crucial data sources.

References