CVE-2026-68527 in Concrete CMS
Summary
by MITRE • 09/10/2026
Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted event occurrence. A user with the "Add Event" permission on a single calendar could read and overwrite events on calendars they were not permitted to access, and could delete an event's original local occurrence. Publishing the injected version to the live calendar, which demotes the previously approved version, additionally required the actor's approve_calendar_event workflow rights or an auto-approving workflow. The Concrete CMS Security Team gave this a rank of 5.9 with CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
Concrete CMS versions ranging from 8.3.0 through 9.5.2 contain a critical authorization bypass vulnerability within the Calendar event edit dialog, specifically located in the concrete/controllers/dialog/event/edit.php component. This flaw stems from an improper implementation of access control checks during the editing process for calendar events. The system fails to validate permissions against the actual owner or identifier of the calendar that contains the targeted event occurrence. Instead, it relies on a calendar identifier supplied directly within the HTTP request parameters. This architectural oversight allows attackers to manipulate the context in which permission checks are performed, effectively decoupling the action from the resource being modified and leading to unauthorized access scenarios.
The operational impact of this vulnerability is significant for any deployment relying on Concrete CMS for event management or scheduling. An attacker possessing only the "Add Event" permission on a single calendar can exploit this flaw to read and overwrite events belonging to calendars they do not have explicit permissions to access. This represents a clear violation of confidentiality and integrity principles, as sensitive information stored in restricted calendars becomes exposed, and existing data can be maliciously altered or corrupted. Furthermore, the vulnerability allows for the deletion of an event's original local occurrence, which disrupts scheduled activities and potentially causes operational downtime or confusion within organizations dependent on accurate calendar data.
The severity is further compounded by the potential to publish these unauthorized modifications to the live calendar environment. When a user injects their modified version into the active calendar, it demotes the previously approved and verified version of the event. This action effectively overwrites legitimate content with malicious or erroneous data without requiring full administrative privileges for all calendars involved. However, the final step of publishing this injected content requires either specific workflow approval rights such as approve_calendar_event or an auto-approving workflow configuration. Consequently, while initial access is granted via a lower-level permission set, achieving persistent impact depends on additional privilege escalation vectors within the CMS's workflow management system.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. The attack vector involves manipulating input parameters to bypass security controls, which is characteristic of broken access control flaws often documented in OWASP Top 10 lists under Injection or Broken Access Control categories. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving privilege escalation and unauthorized data modification, specifically leveraging valid credentials with limited scope to perform actions outside their intended permissions boundary. The Concrete CMS Security Team has assigned a CVSS v4.0 score of 5.9, reflecting attributes such as Network Attack Vector, Low Complexity, No User Interaction required for the initial bypass, but High Privileges Required and Local Impact on Integrity due to the workflow dependencies mentioned earlier.
Mitigation strategies should focus primarily on upgrading Concrete CMS to version 9.5.3 or later where this authorization logic has been corrected to validate permissions against the actual calendar owner rather than request-supplied identifiers. For organizations unable to immediately patch, implementing strict input validation and ensuring that all API endpoints verify resource ownership before processing edit requests is essential. Additionally, reviewing workflow configurations to ensure that auto-approving workflows are not overly permissive can reduce the risk of successful exploitation leading to published malicious content. Regular audits of user permissions should also be conducted to limit the "Add Event" privilege to only those users who genuinely require it for their specific operational roles, thereby reducing the attack surface available to potential adversaries.