Description
Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_source, and delete_data_source), which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester's edit permission on the owning board. A user granted edit_board_settings on a single board was therefore able to modify or permanently delete the configured data sources of any other board on the site, halting the affected board's content feed and resetting its custom weighting. The CSRF token that guards these actions was validated but bound to the action name rather than to the target object, so a token legitimately obtained for one board could be replayed against another board's ConfiguredDataSource identifier and did not constrain access. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Published: 2026-09-15
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification or deletion of board data sources via missing authorization checks
Action: Assess Impact
AI Analysis

Impact

Concrete CMS versions 9 through 9.5.2 contain a missing authorization check in the Boards data source dashboard controller for_data ConfiguredDataSource based on an attacker‑supplied identifier without verifying that the requester has edit permission on the owning board. The CSRF token is validated but is bound only to the action name rather than obtained for one board to be replayed against another. As a result, a user with the edit_board_settings role on a single board can modify or permanently delete the configured data sources of any other board on the site, effectively halting that board’s content feed and resetting its custom weighting. This flaw primarily undermines integrity and can degrade availability of board content.

Affected Systems

The vulnerability applies to Concrete CMS 9.0.0 through 9.5.2, affecting all installations that use the Boards data source dashboard. The flaw permits a low‑privileged board editor with edit_board_settings permission to act on any board’s data source configuration.

Risk and Exploitability

The CVSS base score of 2.1 indicates low severity. The EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated user with edit_board_settings rights. Given these metrics, the overall risk is low.

Generated by OpenCVE AI on September 17, 2026 at 08:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Concrete CMS to a version that implements authorization checks for board data source actions (e.g., versions later than 9.5.2).
  • Restrict the edit_board_settings permission to trusted individuals or limit the number of users granted that role to reduce the attack surface.
  • Implement monitoring or audit logging for changes to ConfiguredDataSource objects, and alert on unexpected deletions or alterations to detect exploitation early.

Generated by OpenCVE AI on September 17, 2026 at 08:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Concretecms
Concretecms concrete Cms
Vendors & Products Concretecms
Concretecms concrete Cms

Tue, 15 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
Description Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_source, and delete_data_source), which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester's edit permission on the owning board. A user granted edit_board_settings on a single board was therefore able to modify or permanently delete the configured data sources of any other board on the site, halting the affected board's content feed and resetting its custom weighting. The CSRF token that guards these actions was validated but bound to the action name rather than to the target object, so a token legitimately obtained for one board could be replayed against another board's ConfiguredDataSource identifier and did not constrain access. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Title Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Concretecms Concrete Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: ConcreteCMS

Published:

Updated: 2026-09-15T19:40:38.678Z

Reserved: 2026-07-30T18:16:52.968Z

Link: CVE-2026-18421

cve-icon Vulnrichment

Updated: 2026-09-15T19:40:34.552Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T19:17:17.010

Modified: 2026-09-16T19:16:15.097

Link: CVE-2026-18421

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T08:15:07Z

Weaknesses