CVE-2026-68529 in Concrete CMS
Summary
by MITRE • 09/15/2026
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries without invoking canViewExpressEntries(), the per-entity permission check that the sibling results() action enforced. An authenticated dashboard user holding view_express_entries on a single Express entity could read the entries of any other entity, including secret attribute values, by requesting the advanced-search action with that entity's ID, disclosing form submissions and CRM-style records across the per-entity permission boundary that Express is designed to enforce. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
Concrete CMS versions ranging from 9.0.0 through 9.5.2 contained a critical authorization bypass vulnerability within the Express module, specifically affecting the advanced-search dashboard action. This flaw stemmed from an inconsistent implementation of permission checks across different methods in the DashboardSelectableExpressEntryListTrait class. The core issue lies in how the application handles access control for viewing data associated with specific Express entities, which are used to store structured content such as forms and customer relationship management records. While the standard results action correctly invoked the canViewExpressEntries method to verify per-entity permissions before rendering data, the advanced_search method failed to perform this same verification step. Instead, it directly resolved an Express entity using a user-supplied identifier and proceeded to render its associated entries without validating whether the requesting user had explicit permission to view that specific entity's data.
This architectural inconsistency allows authenticated users with minimal privileges to escalate their access beyond intended boundaries. Specifically, any dashboard user who holds the view_express_entries permission for at least one Express entity can exploit this flaw by manipulating the request parameters to target other entities they are not authorized to access. By supplying a different entity ID in the advanced-search action, an attacker can retrieve sensitive information belonging to those unauthorized entities. This includes secret attribute values and private form submissions that were intended to remain isolated from users lacking specific permissions for each individual record set. The vulnerability effectively neutralizes the per-entity permission model designed by Concrete CMS to enforce data isolation between different business units or user groups within a single installation.
The operational impact of this flaw is primarily centered on confidentiality, as it enables unauthorized disclosure of structured data that should be restricted based on granular access controls. Although the CVSS v4.0 score assigned by the security team was relatively low at 2.1 due to the requirement for authentication and specific pre-existing permissions, the practical risk remains significant in environments where sensitive customer or employee data is stored within Express entities with varying levels of privacy settings. Attackers can harvest CRM-style records, personal information submitted through forms, and other confidential attributes by systematically iterating through entity IDs once they have identified a valid target ID for which they do possess permission. This capability undermines the integrity of multi-tenant workflows or departmental data segregation strategies implemented within the CMS platform.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key in ATT&CK framework contexts related to privilege escalation via input manipulation. The root cause is a failure to enforce consistent security checks across functionally similar endpoints within the same module. To mitigate this issue, administrators must ensure that Concrete CMS is updated to version 9.5.3 or later where the advanced_search method has been patched to include the necessary canViewExpressEntries check before processing requests. Until an upgrade is performed, organizations should restrict dashboard access to only those users who absolutely require it and monitor logs for unusual patterns of entity ID enumeration that might indicate exploitation attempts. Additionally, implementing strict input validation on all user-supplied identifiers in custom modules or third-party extensions can help prevent similar authorization bypasses in other parts of the application logic.