Executive brief
Concrete CMS, a popular open-source content management system, contains an authorization flaw in its Express Form block that allows authenticated users to modify forms they should not have access to. By reusing a CSRF token obtained from one form, an attacker can add, modify, or delete controls on other forms—potentially injecting malicious code that gets executed when the form is displayed, leading to account compromise or data theft.
Technical details
The vulnerability is an authorization bypass in the Express Form block's control-management actions. The root cause is insufficient permission checking: the block relies solely on CSRF token validation without verifying that the user has edit access to the specific form being targeted. Since CSRF tokens are bound to the user and action type rather than to a specific block, page, or form instance, an authenticated user with edit access to one Express Form can reuse a valid token to perform unauthorized modifications on other Express Forms. This can be exploited to inject a stored XSS payload via a malicious form control that is rendered as HTML. The vulnerability affects Concrete CMS 9.0.0 through 9.5.2 and requires the attacker to be an authenticated user with edit access to at least one Express Form.
Affected products
- Concrete CMS Concrete CMS 9.0.0 through 9.5.2
Timeline
- 2026-09-15: disclosed