CVE-2026-68527: Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog
Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted event occurrence. A user with the "Add Event" permission on a single calendar could read and overwrite events on calendars they were not permitted to access, and could delete an event's original local occurrence. Publishing the injected version to the live calendar, which demotes the previously approved version, additionally required the actor's approvecalendarevent workflow rights or an auto-approving workflow. The Concrete CMS Security Team gave this a rank of 5.9 with CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 8.3.0 through 9.5.2
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs an authenticated account with the "Add Event" permission on at least one calendar. They can then supply that calendar's identifier while targeting an event occurrence owned by a different calendar.
What can an attacker do to events in calendars they cannot access?
They can read and overwrite events on calendars for which they do not have permission, and can delete an event's original local occurrence. Publishing an injected version to the live calendar additionally requires approve_calendar_event workflow rights or an auto-approving workflow.
Which deployments are affected?
Concrete CMS versions 8.3.0 through 9.5.2 are affected. Exposure depends on users having "Add Event" permission on any calendar and the ability to access the Calendar event edit dialog.