CVE-2026-18426: Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit
Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an authenticated user with edit access to one Express Form could reuse a validly obtained token to add, modify, or delete controls on Express Forms they were not authorized to edit, including injecting a control whose value is later rendered as HTML to achieve stored XSS. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yat Wu for reporting.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Concrete CMS installations running versions 9.0.0 through 9.5.2 are affected. Exploitation is limited to authenticated users who can edit at least one Express Form but are not authorized to edit another target Express Form.
What does an attacker need to exploit it?
The attacker needs a valid CSRF token for an Express Form control-management action, obtained while editing a form they are allowed to edit. They must then reuse that token against a different Express Form and induce the required user interaction.
What could a successful attacker do?
They can add, modify, or delete controls on Express Forms they are not permitted to edit. They may also inject a control with a value later rendered as HTML, resulting in stored cross-site scripting.
Does CSRF protection prevent exploitation?
No. The affected control-management actions validate a token bound to the user and action, but not to the specific block, page, or Express Form, allowing the token to be reused against an unauthorized target.