CVE-2026-18122 Overview
CVE-2026-18122 is a Missing Authorization vulnerability [CWE-862] in the Concrete CMS Express REST API. Versions 9.2.0 through 9.5.2 disable the per-entry view permission check on the Express entry collection endpoint. An attacker holding an OAuth token with read scope for an Express entity can enumerate entries that the associated user context is not authorized to view. The disclosed data includes each entry's public identifier, URL, label, dates, and any attribute or associated-entry fields requested through the includes parameter.
Critical Impact
Authenticated OAuth clients can enumerate restricted Express entries and exfiltrate attribute data through the REST API without triggering per-entry authorization checks.
Affected Products
- Concrete CMS 9.2.0
- Concrete CMS versions 9.2.x through 9.5.1
- Concrete CMS 9.5.2
Discovery Timeline
- Vulnerability reported by riodrwn to the Concrete CMS security team
- 2026-09-11 - CVE-2026-18122 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-18122
Vulnerability Analysis
The Concrete CMS REST API exposes Express entities through a collection endpoint that returns lists of entries for a given entity. In affected releases, the list handler skips the per-entry view permission check that is normally applied when a single entry is retrieved directly. The endpoint enforces only the OAuth scope (read on the Express entity) and the caller's authentication state.
Because per-entry access control is bypassed, an OAuth client can iterate the collection and receive every entry the entity contains, regardless of whether the underlying user account is permitted to view each row. The includes parameter compounds the exposure by allowing the caller to expand attribute values and associated-entry references in the response payload.
The issue is scoped to confidentiality of Express entry data. It does not permit modification, deletion, or lateral impact to other Concrete CMS components, as reflected by the vector's VI:N/VA:N/SC:N components.
Root Cause
The root cause is a missing authorization check in the Express entry list endpoint of the REST API. Individual entry retrieval calls the per-entry view permission gate; the list handler was implemented without invoking the same gate before serializing each row into the response.
Attack Vector
Exploitation requires network access to the REST API and a valid OAuth token with read scope for the targeted Express entity. The attacker issues a GET request to the Express entity's entry collection endpoint, optionally supplying includes to expand attributes and associated entries. The server returns entries the token's user context should not be able to view. Attackers can page through the collection to enumerate the full dataset.
No verified proof-of-concept code is published. See the ConcreteCMS Version 9.5 Release Notes for vendor details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-18122
Indicators of Compromise
- Unusual volumes of GET requests to Express entry collection endpoints from a single OAuth client.
- REST API access logs showing repeated pagination against the same Express entity by a low-privilege token.
- OAuth clients with read scope requesting large includes expansions across many entries in a short window.
Detection Strategies
- Correlate REST API request logs with the user context bound to each OAuth token and flag entry retrievals that exceed the user's expected permission set.
- Baseline normal Express API usage per OAuth client and alert on deviations in request rate, response size, or entity diversity.
- Review web server and application logs for HTTP 200 responses on collection endpoints where equivalent single-entry requests would return 403.
Monitoring Recommendations
- Forward Concrete CMS application and access logs to a centralized analytics platform for retention and query.
- Enable audit logging of OAuth token issuance, scope grants, and API consumption for Express entities.
- Alert on new OAuth client registrations that request read scope on sensitive Express entities.
How to Mitigate CVE-2026-18122
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which restores the per-entry view permission check on the Express collection endpoint.
- Inventory OAuth clients and revoke tokens that hold read scope on Express entities containing restricted data.
- Audit REST API logs since the deployment of any 9.2.0-9.5.2 release for signs of unauthorized enumeration.
Patch Information
Concrete CMS addressed the missing authorization check in the 9.5.3 release. Refer to the ConcreteCMS Version 9.5 Release Notes for the fix description and upgrade guidance. The Concrete CMS security team assigned a CVSS v4.0 base score of 6.0 to this issue.
Workarounds
- Disable or restrict the Concrete CMS REST API if it is not required in your deployment.
- Remove read scope from OAuth clients that do not require programmatic access to Express entries.
- Restrict network access to the REST API endpoints using a reverse proxy or web application firewall until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
