CVE-2026-81916: Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object
Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Express object outside their authorization scope, potentially polluting protected datasets, triggering workflows, or injecting content into administrative processes. The dashboard submit route resolved the mutated entity from the attacker-controlled route ID while the permission check validated the independently posted form's entity, and the submission proceeded because the two entities were never compared. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMS Express Entries Dashboardto a version that resolves this vulnerability.Fixed in 9.5.3 - Compensating control
Until upgrading, restrict access to Express entry submission/dashboard routes so only authorized users who should be able to create entries in the target Express object can reach the submit endpoint.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with permission to add entries to at least one Express object can exploit it. The published CVSS vector indicates high privileges are required, but no user interaction is required.
What is the practical impact of exploitation?
The attacker can create entries in a different Express object for which they do not have authorization. This can pollute protected datasets, trigger workflows, or inject content into administrative processes.
What should be updated to address the issue?
Update Concrete CMS to version 9.5.3 or later. Versions before 9.5.3 are affected by the authorization mismatch between the submitted form entity and the dashboard route entity.