Executive brief
Concrete CMS, a popular content management system, failed to properly restrict access to advanced search functionality for Express entries (a data collection feature). An authenticated user with limited permissions on one data entity could exploit this flaw to view sensitive entries from other entities, including hidden form fields and customer records, crossing security boundaries designed to keep different datasets separate.
Technical details
The vulnerability is an authorization bypass in the DashboardSelectableExpressEntryListTrait component. The advanced_search() method resolves an Express entity directly from user-supplied input and displays its entries without invoking the canViewExpressEntries() permission check that the sibling results() action correctly enforces. An authenticated dashboard user with view_express_entries permission on at least one Express entity can call the advanced-search action with another entity's ID to disclose entries across the per-entity permission boundary. The attack requires authentication and existing minimal permissions on the target system. A patch is available in Concrete CMS 9.5.3 or later.
Affected products
- Concrete CMS Concrete CMS 9.0.0 through 9.5.2
Timeline
- 2026-09-15: disclosed