Executive brief
Concrete CMS, a popular open-source content management platform, contains an authorization flaw in its board management feature. An attacker with edit permissions on one board can modify or delete data sources (content feeds) on any other board on the site, disrupting content display and custom settings. The vulnerability bypasses access controls despite CSRF token validation due to improper token binding.
Technical details
The vulnerability is an authorization bypass in the Boards data source dashboard controller affecting three actions: update, update_data_source, and delete_data_source. The vulnerable code resolves ConfiguredDataSource objects directly from user-supplied identifiers without verifying the requester's edit permission on the owning board. Although CSRF tokens are validated, they are bound to the action name rather than the target object, allowing tokens obtained for one board to be replayed against another board's data sources. A user with edit_board_settings privilege on any single board can exploit this to modify or permanently delete data sources on other boards. No patch availability information is provided in the advisory.
Affected products
- Concrete CMS Concrete CMS 9.0 through 9.5.2
Timeline
- 2026-09-15: disclosed