Concrete CMS versions 9.0.0 through 9.5.2 failed to verify user authorization when performing actions on board instances. The single-page controller accepts an instance ID from a request, resolves the corresponding board instance, and allows viewing, refreshing, regenerating, or deleting it without checking whether the user has edit_board_settings permission on the parent board. As a result, a user with edit rights on one board can access or delete instances belonging to any other board, enabling privilege escalation within the CMS.

Affected product is Concrete CMS, with impacted versions from 9.0.0 through 9.5.2. The vulnerability exists across all builds in this range, regardless of deployment environment.

The CVSS v4.0 score of 2.1 indicates a low severity issue. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need an account that already has board‑edit rights; they could then supply arbitrary instance IDs and review the CSRF token logic to perform the action. Because the flaw bypasses the standard permission‑checked accessor and relies only on an action‑scoped CSRF token, exploitation requires only legitimate credentials and knowledge of instance identifiers, making it a low‑effort privilege escalation within a compromised CMS installation.