Quick answers
- Is CVE-2026-68530 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-68530 being exploited in the wild.
- How severe is CVE-2026-68530?
- Informational severity, with a CVSS score of 2.1, published 15 September 2026.
- Which products and versions are affected?
- Concrete CMS 9 through 9.5.2.
- Is there a fix for CVE-2026-68530?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-68530 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-68530?
- Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass in the Boards Dashboard area of Concrete CMS affecting versions 9 through 9.5.2. The board-instance single-page controller resolves a board instance directly from attacker-supplied instance IDs (view, refresh, regenerate, delete actions) without verifying the requester has edit_board_settings permission on the parent board. The vulnerable actions bypass the controller's permission-checked accessor and rely only on action-scoped CSRF token validation, which is reusable across different boards. An authenticated user with board-edit rights on any board can reach and manipulate instances of other boards by supplying their IDs. The fix involves enforcing proper authorization checks before performing instance operations.
Affected products
- Concrete CMS Concrete CMS 9 through 9.5.2
Timeline
- 2026-09-15: disclosed