Concrete CMS versions 9.0.0 through 9.5.2-search dashboard action. The advanced_search() method directly resolves an Express entity from a user‑supplied ID and renders that entity's entries without invoking canViewExpressEntries(), the per-entity permission check normally enforced by the sibling results() action. As a result, an authenticated dashboard user who possesses the view_express_entries privilege on any single Express entity can read the entries of other entities—including secret attribute values—by requesting the advanced‑search action with the target entity’s ID. This omission permits unauthorized different Express entries and violates the entity‑level access controls that Express is designed to enforce.

This vulnerability is limited to Concrete CMS from the company Concrete CMS in released versions 9.0.0 up to and including 9.5.2. The impacted functionality is the advanced‑search endpoint within the dashboard of the Express component, which can be invoked by users with dashboard access and the view_express_entries permission.

The CVSS v4 score of 2.1 indicates low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. However, the flaw remains exploitable by any authenticated dashboard user with a the view_express_entries privilege—and allows reading entries belonging to other entities. The impact is primarily information disclosure, and the attack vector is remote, requiring only appropriate authentication and the ability to trigger the advanced‑search action. In environments where Express entries contain sensitive business data, the risk can constitute a moderate threat once it is discovered due to the potential for cross‑entity data leakage.