CVE-2026-18421: Concrete CMS Auth Bypass Vulnerability

CVE-2026-18421 Overview

CVE-2026-18421 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions 9 through 9.5.2. The flaw resides in the Boards data source dashboard controller, specifically in the update, update_data_source, and delete_data_source actions. These actions resolve a ConfiguredDataSource object directly from an attacker-supplied identifier without verifying the requester's edit permission on the owning board.

An authenticated user granted edit_board_settings on any single board can modify or delete data sources belonging to other boards on the site. Concrete CMS resolved the issue in release 9.5.3. The vulnerability was reported by Winston Crooker.

Critical Impact

A low-privileged board editor can halt content feeds and reset custom weighting on any board across the site by tampering with foreign ConfiguredDataSource identifiers.

Affected Products

• Concrete CMS 9.0 through 9.5.2
• Concrete CMS Boards feature (data source dashboard controller)
• Fixed in Concrete CMS 9.5.3

Discovery Timeline

• 2026-09-15 - CVE-2026-18421 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18421

Vulnerability Analysis

The Boards feature in Concrete CMS lets site administrators configure content sources that feed board layouts. Each board carries an edit_board_settings permission that governs who may adjust its configuration. The dashboard controller exposes three actions that mutate configured data sources: update, update_data_source, and delete_data_source.

Each of these actions accepts a ConfiguredDataSource identifier from the request and loads the corresponding object directly. The controller never re-checks whether the acting user holds edit_board_settings on the board that owns the resolved data source. As a result, permission granted on Board A is silently honored when acting on Board B's data sources.

The practical impact is integrity and availability loss: an attacker can rewrite data source configuration, delete data sources outright, halt an affected board's content feed, and reset custom weighting values. No confidentiality impact is documented.

Root Cause

The root cause is a broken access control pattern [CWE-862]. The controller trusts the identifier supplied by the client and performs the action against whatever object that identifier resolves to. Authorization is scoped to the action name rather than to the target board.

A secondary weakness compounds the flaw. The Cross-Site Request Forgery (CSRF) token that protects these actions is validated but bound only to the action name, not to the target ConfiguredDataSource or its owning board. A token legitimately obtained by an attacker for their own board can be replayed against any other board's data source identifier.

Attack Vector

Exploitation requires an authenticated user account with edit_board_settings on at least one board. The attacker obtains a valid CSRF token for one of the three controller actions on their own board, then submits the request while substituting a ConfiguredDataSource identifier that belongs to a different board. The server processes the request without validating cross-board permission.

The vulnerability manifests in the Boards data source dashboard controller. See the ConcreteCMS Release Notes 9.5.3 for the vendor's remediation notes.

Detection Methods for CVE-2026-18421

Indicators of Compromise

• Unexpected changes to board content feeds, including halted feeds or missing items on boards a given user does not own.
• Reset or unexplained changes to custom weighting values on ConfiguredDataSource records.
• HTTP POST requests to Boards data source controller actions update, update_data_source, or delete_data_source referencing ConfiguredDataSource identifiers that do not belong to any board the requesting user administers.

Detection Strategies

• Audit Concrete CMS application logs for the three affected controller actions and correlate the acting user against the owning board of each targeted ConfiguredDataSource.
• Alert when a single authenticated session issues data source mutations spanning multiple distinct boards within a short window.
• Compare current data source configurations and weighting values against known-good backups to identify unauthorized modification or deletion.

Monitoring Recommendations

• Enable verbose logging for the Concrete CMS Boards dashboard controller and forward records to a centralized log platform.
• Track deletion events on ConfiguredDataSource objects and require review when the acting user is not a site administrator.
• Monitor board content feed availability metrics to catch outages caused by unauthorized data source deletion.

How to Mitigate CVE-2026-18421

Immediate Actions Required

• Upgrade Concrete CMS to version 9.5.3 or later, which enforces the correct authorization check on the Boards data source controller.
• Review the roster of users holding edit_board_settings on any board and revoke the permission where it is not required.
• Restore any data sources or weighting configurations that were modified or deleted without authorization from a trusted backup.

Patch Information

Concrete CMS addressed CVE-2026-18421 in the 9.5.3 release. The fix adds an authorization check that confirms the requester holds edit_board_settings on the board that owns the resolved ConfiguredDataSource before executing update, update_data_source, or delete_data_source. Details are documented in the ConcreteCMS Release Notes 9.5.3.

Workarounds

• Restrict the edit_board_settings permission to trusted administrators until the upgrade to 9.5.3 is complete.
• Place the /dashboard/boards/data_sources routes behind an additional access control layer, such as a Web Application Firewall (WAF) rule that limits access by source address or authenticated role.
• Take frequent backups of Boards configuration so that unauthorized deletions or weighting resets can be reverted quickly.