CVE-2026-68535: Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager visibility. As a result, an authenticated user holding the block-add scope could store, and cause the page to render, a reference to a file that the file-manager authorization policy would otherwise reject, disclosing that file's URL and preview to the editor and to visitors of the affected page. Under public file storage, the URL and thumbnail are exposed directly; under private storage, the disclosure is limited by the permission-checked download URL. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.2 - Compensating control
If feasible, restrict access to the Concrete CMS Area API block-create endpoint so only users with the correct file-manager permissions can create blocks that reference files (prevents referencing files outside file-manager visibility).
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have the block-add scope. The issue is relevant to editors who can create blocks through the Area REST API but should not be able to access certain files under the file-manager authorization policy.
What information could be exposed?
For file-referencing blocks such as hero_image and gallery, an editor can cause a page to reference a file outside their permitted visibility. This can disclose the file URL and preview to the editor and to visitors of the affected page.
Does the storage configuration affect the impact?
Yes. With public file storage, the file URL and thumbnail are directly exposed; with private storage, disclosure is constrained by the permission-checked download URL.
How can I determine whether a site is affected?
Concrete CMS versions 9.2.0 through 9.5.2 are affected. Review Area REST API block creation by users with block-add scope, especially submitted hero_image or gallery block data that references files outside the creator's normal file-manager visibility.