CVE-2026-18426: Concrete CMS Express Form block authorization bypass

CVE-2026-18426 · Severity: medium · CVSS 6.5 · Published 2026-09-15

Concrete CMS, a popular open-source content management system, contains an authorization flaw in its Express Form block that allows authenticated users to modify forms they should not have access to. By reusing a CSRF token obtained from one form, an attacker can add, modify, or delete controls on other forms—potentially injecting malicious code that gets executed when the form is displayed, leading to account compromise or data theft.

Technologies: Concrete CMS. Vendors: Concrete CMS.

Quick answers

Is CVE-2026-18426 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18426 being exploited in the wild.
How severe is CVE-2026-18426?
Medium severity, with a CVSS score of 6.5, published 15 September 2026.
Which products and versions are affected?
Concrete CMS 9.0.0 through 9.5.2.
Is there a fix for CVE-2026-18426?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18426 attacked?
It is attacked over the network.
Am I affected by CVE-2026-18426?
Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the Express Form block's control-management actions. The root cause is insufficient permission checking: the block relies solely on CSRF token validation without verifying that the user has edit access to the specific form being targeted. Since CSRF tokens are bound to the user and action type rather than to a specific block, page, or form instance, an authenticated user with edit access to one Express Form can reuse a valid token to perform unauthorized modifications on other Express Forms. This can be exploited to inject a stored XSS payload via a malicious form control that is rendered as HTML. The vulnerability affects Concrete CMS 9.0.0 through 9.5.2 and requires the attacker to be an authenticated user with edit access to at least one Express Form.

Affected products

  • Concrete CMS Concrete CMS 9.0.0 through 9.5.2

Timeline

  • 2026-09-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.