CVE-2026-18421: Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control
Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, updatedatasource, and deletedatasource), which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester's edit permission on the owning board. A user granted editboardsettings on a single board was therefore able to modify or permanently delete the configured data sources of any other board on the site, halting the affected board's content feed and resetting its custom weighting. The CSRF token that guards these actions was validated but bound to the action name rather than to the target object, so a token legitimately obtained for one board could be replayed against another board's ConfiguredDataSource identifier and did not constrain access. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be an authenticated user with edit_board_settings permission on at least one board. They can then target configured data sources belonging to other boards without having edit permission for those boards.
Does the CSRF token prevent cross-board abuse?
No. Although the affected actions validate a CSRF token, the token is bound only to the action name and not to the target configured data source or its owning board, allowing a token obtained for one board to be replayed against another board's identifier.
What is the practical impact on a targeted board?
An attacker can modify or permanently delete its configured data sources. This can halt the board's content feed and reset its custom weighting.