Authorization Flaw in Concrete CMS Affects Board Instance Actions

CVE-2026-68530

What is CVE-2026-68530?

Concrete CMS versions 9 through 9.5.2 contain an authorization vulnerability that permits attackers to manipulate board instance actions without proper access controls. Specifically, the system fails to validate user permissions when processing requests with attacker-supplied instance IDs. This can lead to unauthorized viewing, refreshing, regeneration, or deletion of any board instance on the site, allowing users with limited board-edit rights to exploit instance IDs and access restricted data. The issue arises from the bypassing of permission checks and relies solely on action-scoped CSRF tokens, which are not unique to the specific instances being manipulated. This vulnerability underscores the necessity for robust authorization checks within web applications to safeguard sensitive data.

References