Executive brief
Concrete CMS, a popular open-source content management system, contains an authorization flaw in its calendar event editing feature. A user with "Add Event" permission on one calendar can read, modify, or delete events on other calendars they should not have access to. This could allow unauthorized changes to shared calendar content and potential disruption of calendar operations.
Technical details
The vulnerability is an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog validates permissions against the calendar identifier supplied in the user request rather than the calendar that actually owns the targeted event. An authenticated user with the "Add Event" permission on a single calendar can exploit this to read and overwrite events on calendars outside their assigned scope, and delete event occurrences. Publishing changes to the live calendar requires additional approve_calendar_event workflow rights or an auto-approving workflow. The vulnerability affects versions 8.3.0 through 9.5.2 and requires network access and authenticated user privileges.
Affected products
- Concrete CMS Concrete CMS 8.3.0 through 9.5.2
Timeline
- 2026-09-10: disclosed