Executive brief
Concrete CMS, a popular open-source content management system, contains a privilege escalation vulnerability in its Page Type management feature. A logged-in administrator with permission to edit one Page Type could modify the configuration of other Page Types outside their assigned authorization boundary, potentially compromising content governance and editorial workflows.
Technical details
The vulnerability is an object-level authorization bypass in the Types::submit() dashboard controller. When a Page Type is updated via the ptID parameter, the code validates the CSRF token (update_page_type) but fails to call canEditPageType() to check whether the user is authorized to modify that specific Page Type. The CSRF token is user- and action-scoped rather than object-scoped, allowing an authenticated dashboard user to target any Page Type via direct parameter manipulation. An attacker with dashboard access and Page Type editing permissions can modify arbitrary Page Type configurations. The issue affects Concrete CMS versions below 9.5.3; patching requires updating to 9.5.3 or later.
Affected products
- Concrete CMS Concrete CMS below 9.5.3
Timeline
- 2026-09-11: disclosed