CVE-2026-68529: Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch() method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries without invoking canViewExpressEntries(), the per-entity permission check that the sibling results() action enforced. An authenticated dashboard user holding viewexpressentries on a single Express entity could read the entries of any other entity, including secret attribute values, by requesting the advanced-search action with that entity's ID, disclosing form submissions and CRM-style records across the per-entity permission boundary that Express is designed to enforce. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated dashboard user with the view_express_entries permission on at least one Express entity. They can then target other Express entities through the advanced-search action.
What information could be exposed?
The issue can expose entries belonging to other Express entities, including secret attribute values. This may disclose form submissions and CRM-style records that should be separated by per-entity permissions.
Are all Concrete CMS installations affected by default?
The issue requires a dashboard user to hold view_express_entries on at least one Express entity. The provided information does not establish that this permission is granted by default.
How can I determine whether access boundaries may have been bypassed?
Review use of the Express entries advanced-search dashboard action by authenticated dashboard users who have view_express_entries access to one entity. Requests using entity IDs for entities outside the user's assigned permissions are relevant indicators.