CVE-2026-87028 in Concrete CMS
Summary
by MITRE • 09/16/2026
Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an authenticated user holding edit-board-contents permission on a single board instance could submit the identifier of an item belonging to a different board instance and receive summary fields, including the page title and description, of an underlying page the same user was otherwise forbidden to view. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Pakung for reporting.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Concrete CMS versions 9 through 9.5.3 represents a critical failure in server-side access control logic, specifically within the custom-slot preview endpoint. This flaw allows an authenticated user to bypass intended permission boundaries by manipulating input parameters associated with board instances. The core technical deficiency lies in the application's inability to validate that the InstanceItem identifier submitted during a request actually belongs to the specific board instance for which the requesting user holds edit permissions. Furthermore, the system fails to enforce page-view permissions before generating summary content derived from underlying pages. This lack of proper authorization checks creates a direct path for information disclosure, as the application processes requests without verifying whether the target resource is accessible to the current user context beyond their immediate editing rights on a different board instance.
From an operational perspective, this vulnerability enables unauthorized data retrieval through what is known as insecure direct object reference behavior. An attacker who possesses edit-board-contents permissions for one specific board can exploit the preview functionality by submitting identifiers belonging to items associated with entirely separate board instances. Upon processing such a request, the application generates and returns summary fields that include sensitive metadata from underlying pages, specifically page titles and descriptions. Crucially, this information is disclosed even if the user has no inherent permission to view those specific pages or access the content within them. The impact is strictly limited to visual information disclosure, as there are no indications of code execution or data modification capabilities in this vector, yet it still poses a significant risk by exposing internal site structures and potentially sensitive page metadata that should remain hidden from unauthorized users.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-284 Improper Access Control, as the application fails to properly restrict access to resources based on user privileges. It also maps directly to CWE-639 Authorization Bypass Through User-Controlled Key, where the attacker uses a controlled key (the InstanceItem identifier) to bypass authorization checks for a different resource. Within the MITRE ATT&CK framework, this behavior is characteristic of T1078 Valid Accounts and potentially T1530 Data from Cloud Storage or Local System Files if the underlying pages contain sensitive data, though primarily it falls under information gathering techniques enabled by improper access control mechanisms. The vulnerability highlights a common architectural flaw where frontend editing permissions are incorrectly assumed to grant broader read access across unrelated resource hierarchies without explicit verification of target object ownership and visibility rules.
The Concrete CMS security team has assigned this issue a CVSS v4.0 score of 5.3, reflecting its medium severity due to the network-based attack vector, low complexity, and lack of user interaction requirements. The vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N indicates that while confidentiality is impacted locally for the victim organization, there are no impacts to integrity or availability, and scoped privileges remain unaffected because the attacker cannot modify data. Mitigation strategies should prioritize immediate patching to version 9.5.4 or later where these authorization checks have been corrected. In environments where upgrading is not immediately feasible, administrators can implement web application firewall rules to restrict access to the custom-slot preview endpoint based on strict validation of board instance ownership and ensure that all page-view permissions are explicitly checked before any summary content generation occurs. Regular security audits focusing on object-level permission enforcement across related but distinct resource types are recommended to prevent similar bypasses in other modules.