CVE-2026-18116: Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications

Q: Which deployments are exposed to this issue?

Concrete CMS versions 8.3.0 through 9.5.2 are affected where a calendar uses an approval workflow and users are permitted to add calendar events. The vulnerable rendering occurs in dashboard workflow approval and deletion notifications shown in the "Waiting For Me" block.

Q: What access does an attacker need?

An attacker must be a registered user with permission to add events to a calendar that is governed by an approval workflow. They can place a script payload in an event name and rely on the pending request being displayed to an administrator.

Q: What is the likely impact if exploitation succeeds?

The script executes in the administrator's browser when the pending workflow request is displayed. The vulnerability can be used to create a new administrator account.

Published Sep 14, 2026

Updated

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval workflow could submit an event whose name contained a script payload, which then executed in an administrator's browser when the pending request was displayed and could be used to create a new administrator account. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks v01demort for reporting.

Affected Software

1 affected component

Concrete CMS Concrete CMS>=8.3.0<=9.5.2

Event History

Sep 14, 2026

CVE Published

via MITRE·10:05 PM

Data Sourced

via MITRE·10:05 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Concrete CMS versions 8.3.0 through 9.5.2 are affected where a calendar uses an approval workflow and users are permitted to add calendar events. The vulnerable rendering occurs in dashboard workflow approval and deletion notifications shown in the "Waiting For Me" block.

What access does an attacker need?

An attacker must be a registered user with permission to add events to a calendar that is governed by an approval workflow. They can place a script payload in an event name and rely on the pending request being displayed to an administrator.

What is the likely impact if exploitation succeeds?

The script executes in the administrator's browser when the pending workflow request is displayed. The vulnerability can be used to create a new administrator account.