CVE-2026-68526: Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller
Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission, so a crafted cross-site request could cause an authenticated user with add-event permission to create duplicate CalendarEvents and CalendarEventVersions records under their own authority. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Compensating control
If immediate upgrade is not possible, mitigate CSRF by restricting cross-site requests to the Concrete CMS instance (e.g., ensure the application uses/validates anti-CSRF tokens for the Calendar event duplicate dialog controller) and limit access to the endpoint so only trusted users from legitimate sessions can reach it.
Event History
Frequently Asked Questions
Who is exposed to this issue?
An authenticated Concrete CMS user who has access to the Calendar duplicate dialog and permission to add calendar events can be targeted. The resulting duplicate events and event versions are created under that user's authority.
What does an attacker need to exploit it?
The attacker needs to induce a qualifying authenticated user to submit a crafted cross-site request. No attacker authentication or special privileges are required, but user interaction is required.
Are default permissions enough for exploitation?
No. The affected submit action checks both canAccess() and the per-resource canAddCalendarEvent() permission, so the targeted user must have permission to add calendar events.
What is the impact if exploitation succeeds?
The attacker can cause duplicate CalendarEvents and CalendarEventVersions records to be created. The provided CVSS v4.0 vector indicates low integrity impact and no confidentiality or availability impact.