Executive brief
Concrete CMS, a popular content management system, does not properly verify user permissions when managing board instances in the Dashboard. An attacker with edit rights on one board can view, modify, or delete instances from other boards on the same site by directly guessing or supplying board instance IDs, potentially exposing or disrupting collaborative work areas.
Technical details
The vulnerability is an authorization bypass in the Boards Dashboard area of Concrete CMS affecting versions 9 through 9.5.2. The board-instance single-page controller resolves a board instance directly from attacker-supplied instance IDs (view, refresh, regenerate, delete actions) without verifying the requester has edit_board_settings permission on the parent board. The vulnerable actions bypass the controller's permission-checked accessor and rely only on action-scoped CSRF token validation, which is reusable across different boards. An authenticated user with board-edit rights on any board can reach and manipulate instances of other boards by supplying their IDs. The fix involves enforcing proper authorization checks before performing instance operations.
Affected products
- Concrete CMS Concrete CMS 9 through 9.5.2
Timeline
- 2026-09-15: disclosed