CVE-2026-68530 in Concrete CMS
Summary
by MITRE • 09/15/2026
Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, or deleted it without verifying that the requester held edit_board_settings on the instance's parent board. As a result, a user granted board-edit rights on a single board could reach the instances of any other board on the site by supplying their instance IDs. The affected actions bypassed the controller's permission-checked accessor (the same accessor used by the read view, which runs canEditBoardSettings on the parent board) and validated only an action-scoped CSRF token, which is bound to the action name rather than to the target object and is therefore reusable across boards. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
Concrete CMS versions ranging from 9 through 9.5.2 contain a critical authorization bypass vulnerability within the Boards area of its Dashboard interface. This flaw stems from an improper implementation of access control mechanisms in the instance details single-page controller, which is responsible for managing specific board instances. The core technical deficiency lies in the fact that this controller resolves and processes actions on a board instance directly using an attacker-supplied identifier without performing any verification to ensure the requesting user possesses the necessary permissions relative to the parent board of that instance. Specifically, the system fails to check whether the requester holds the edit_board_settings permission for the specific board associated with the targeted instance ID. This architectural oversight allows users who have been granted limited editing rights on one particular board to arbitrarily manipulate instances belonging to completely different boards across the entire site simply by manipulating the instance identifier in their requests.
The operational impact of this vulnerability is significant because it enables unauthorized modification, deletion, or regeneration of board instances that should be protected from such actions. An attacker with low-level privileges can effectively escalate their influence beyond their assigned scope, potentially disrupting community interactions, deleting critical discussion threads, or causing service disruption through resource exhaustion via instance regeneration. Although the affected endpoints do validate an action-scoped Cross-Site Request Forgery token to prevent certain types of automated attacks, this security measure is insufficient against direct authorization bypasses. The CSRF token in question is bound strictly to the name of the action being performed rather than to the specific target object or resource context. Consequently, a valid CSRF token obtained for an allowed action on one board can be reused to perform unauthorized actions on any other board instance within the system, rendering this defense mechanism ineffective against targeted privilege escalation attacks by authenticated users with minimal initial permissions.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key. The failure to validate user privileges against the specific resource being accessed represents a classic instance of insecure direct object references where the system trusts client-supplied identifiers without verifying ownership or permission rights in relation to those objects. In terms of tactical mapping, this behavior corresponds to ATT&CK technique T1078 Valid Accounts and specifically relates to privilege escalation within authenticated sessions. The vulnerability allows an attacker with valid credentials but limited scope to expand their operational reach across the application environment, violating the principle of least privilege that underpins secure system design.
The Concrete CMS security team has assessed this issue with a CVSS v4.0 base score of 2.1, indicating low severity primarily due to the requirement for high privileges and lack of confidentiality impact in the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Despite the relatively low score, which reflects that an attacker must already be authenticated with some level of access and cannot steal sensitive data or cause widespread denial of service, the potential for administrative disruption remains a serious concern for community-driven platforms relying on structured board interactions. Mitigation strategies should focus on immediate patching to version 9.5.3 or later where this authorization check has been corrected. Until patches are applied, administrators can implement web application firewall rules that monitor for anomalous patterns of instance ID manipulation by users with low-level permissions and enforce stricter server-side validation logic that explicitly ties action execution rights to the parent board context rather than relying solely on generic CSRF tokens.