Concrete CMS versions prior to 9.5.3 perform authorization checks against the entity posted in the form instead of the entity referenced by the dashboard route. Because the two entities are never compared, a user granted permission to create entries in one Express object can create entries in a different Express object that lies outside their authorization scope. This may corrupt protected datasets, trigger unintended workflows, or inject content into administrative processes, thereby compromising data integrity and potentially undermining administrative controls.

All Concrete CMS installations running any version earlier than 9.5.3 are affected. The vulnerability impacts the Express Entries Dashboard feature and applies to any Express objects configured within the system, regardless of the specific schema or permissions applied.

The CVSS score of 5.1 indicates a medium severity flaw that can be leveraged remotely by an authenticated user with high privileges, as reflected in the attack vector and privilege requirements. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires a valid user session and the capability to craft a request to the vulnerable dashboard route, the primary attack path involves authenticated interaction with the CMS’s web interface. The impact is limited to the unauthorized creation of entries, but the availability of complex workflows may amplify downstream consequences. Overall, the risk is moderate yet actionable, especially for systems that expose Express entry dashboards to users with elevated permissions.