CVE-2026-18120 Overview
CVE-2026-18120 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions before 9.5.3. A legacy Express entry search endpoint returned entry result JSON without invoking the canViewExpressEntries() permission check that the normal dashboard and CSV Export flow enforce.
An unauthenticated visitor who knows or discovers an Express entity identifier can enumerate that entity's entry search results. The response discloses attribute values intended for privileged users. For Express entities that do not support entry-specific permissions, EntryList::ignorePermissions() additionally disables per-entry permission filtering, widening the exposure.
Critical Impact
Unauthenticated attackers can read attribute data from Express entities that should be restricted, resulting in confidentiality loss without any user interaction.
Affected Products
- Concrete CMS versions prior to 9.5.3
- Concrete CMS 9.x branch legacy Express entry search endpoint
- Express entities where supportsEntrySpecificPermissions() returns false are especially exposed
Discovery Timeline
- Vulnerability reported by Daniel Powell to the Concrete CMS security team
- 2026-09-16 - CVE-2026-18120 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-18120
Vulnerability Analysis
The flaw resides in a legacy Express entry search endpoint in Concrete CMS. Standard dashboard workflows and the CSV Export path gate access with canViewExpressEntries(), ensuring only authorized users retrieve entry data. The legacy endpoint bypasses this gate and returns entry result JSON to any caller.
Because the endpoint accepts an Express entity identifier as input, an attacker only needs to know or guess that identifier to receive attribute values from the corresponding entity. The response reveals data that the application otherwise restricts to privileged operators.
A secondary weakness compounds the issue. When an Express entity's supportsEntrySpecificPermissions() method returns false, the code path invokes EntryList::ignorePermissions(). This disables per-entry filtering entirely, so all matching entries return to the unauthenticated caller.
Root Cause
The root cause is missing authorization on a legacy code path. The developers added canViewExpressEntries() to newer flows but did not retrofit the check onto the legacy search endpoint. The design assumption that entity identifiers are secret does not hold in practice, and the ignorePermissions() shortcut removes the remaining defense-in-depth layer.
Attack Vector
Exploitation occurs over the network with no authentication or user interaction. The attacker discovers or enumerates an Express entity identifier, then issues an HTTP request to the legacy Express entry search endpoint referencing that identifier. The server returns JSON containing attribute values from matching entries.
Refer to the ConcreteCMS Version 9.5.3 Release Notes for the vendor's technical description of the fix.
Detection Methods for CVE-2026-18120
Indicators of Compromise
- Unauthenticated HTTP requests to the legacy Express entry search endpoint returning HTTP 200 with JSON payloads containing Express attribute data
- Sequential or high-volume requests iterating Express entity identifiers from a single client
- Requests from anonymous sessions accessing Express search parameters that normally originate from the authenticated dashboard
Detection Strategies
- Inspect web server and application logs for calls to the legacy Express entry search route without an authenticated session cookie
- Alert on JSON responses containing Express entry attribute fields returned to unauthenticated user agents
- Deploy WAF rules that require an authenticated dashboard session for any Express entry search request
Monitoring Recommendations
- Baseline normal Express search traffic and flag deviations in request volume, source IPs, or entity identifier ranges
- Forward Concrete CMS access logs to a centralized analytics platform for correlation across sessions and endpoints
- Track anomalous data egress volumes tied to the Express search endpoint
How to Mitigate CVE-2026-18120
Immediate Actions Required
- Upgrade all Concrete CMS installations to version 9.5.3 or later
- Audit web server logs for prior unauthenticated access to the legacy Express entry search endpoint
- Rotate or review Express entity identifiers considered sensitive and assess data exposure
Patch Information
Concrete CMS 9.5.3 adds the canViewExpressEntries() permission check to the legacy Express entry search endpoint, aligning it with the dashboard and CSV Export flow. Administrators should apply the update following the ConcreteCMS Version 9.5.3 Release Notes.
Workarounds
- Restrict access to the legacy Express entry search endpoint at the reverse proxy or WAF until the patch is applied
- Require authentication on all /ccm/system/search/express_entries style routes via web server rules
- Remove or disable Express entities that expose sensitive attribute data if patching is not immediately feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
