Authorization Weakness in Concrete CMS Affecting User Data Access

CVE-2026-68529

What is CVE-2026-68529?

A vulnerability in Concrete CMS allows authenticated users with limited permissions to access sensitive data from other entities. Specifically, users with view_express_entries permission for one entity are capable of retrieving entries from any other entity by leveraging the advanced-search feature without passing necessary authorization checks. This oversight permits unauthorized access to confidential information, including secret attributes and form submissions, which undermines the application's intended access controls.

References