Block-Level Permission Bypass in Concrete CMS by Concrete Solutions

CVE-2026-18426

What is CVE-2026-18426?

Concrete CMS versions 9.0.0 through 9.5.2 have a security issue where the Express Form block does not enforce proper permission checks for control management. The existing reliance solely on CSRF token validation allows authenticated users with edit access to one Express Form to exploit valid tokens. This exploitation enables unauthorized users to modify, add, or delete controls of Express Forms they shouldn't have access to, potentially leading to stored cross-site scripting (XSS) vulnerabilities, as the injected data could be rendered as HTML.

References