Concrete CMS versions 9.0.0 through 9.5.2 failed to verify user authorization when the single-page controller accepts an instance ID from a request, resolves the corresponding board instance, and allows viewing, refreshing, regenerating, or deleting it without checking that the requester had the edit_board_settings permission on the instance’s parent board. The controller only validated an action-scoped CSRF token, which is bound to the action name rather than the target object and is therefore reusable across boards. As a result, a user with board-edit rights on one board can access or delete instances belonging to any other board, enabling privilege escalation within the CMS.

Affected product is Concrete CMS, with impacted versions from 9.0.0 through 9.5.2. The vulnerability exists across all builds in this range, regardless of deployment environment.

The CVSS v4.0 score of 2.1 indicates a low severity issue, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need an account that already has board-edit rights; they could then supply arbitrary instance IDs to view, refresh, regenerate, or delete board instances. Because the flaw bypasses the standard an action-scoped CSRF token, exploitation requires only legitimate credentials and knowledge of instance identifiers, making it a low-effort privilege escalation within a compromised CMS installation.