Executive brief
Concrete CMS, a popular content management system, contains a security flaw in its user management dashboard. An authorized user with access to the bulk user assignment tool can bypass security checks to add themselves or others to the Administrative Group, or even remove existing administrators. This could allow a lower-privileged user to take full control of the website and its data.
Technical details
A missing authorization check in `bulk_user_assignment.php` allows authenticated users who have access to the bulk user assignment dashboard page to perform unauthorized group modifications. By exploiting this flaw, an attacker can add any user email to any group (including the Administrative Group) and remove legitimate administrators. The vulnerability is categorized as Incorrect Authorization (CWE-863). It requires 'High' privileges to access the dashboard component but allows for a complete compromise of integrity and availability within the CMS. The issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory
- 2026-06-24: patched: Advisory updated with patch details for version 9.5.1