CVE-2026-18423 Overview
CVE-2026-18423 is an Insecure Direct Object Reference (IDOR) vulnerability in Concrete CMS versions 9.0.0 through 9.5.2. The flaw resides in the Express saved search preset delete and edit dialogs. An authenticated user with only view permission on a single Express entity can permanently delete or rename saved search presets belonging to Express entities they do not own. Deleted presets cannot be recovered. Renamed presets are displayed back to users of the targeted entity, creating opportunities for defacement or social engineering. The issue is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated users with minimal permissions can permanently delete or rename saved search presets across Express entities they do not own, enabling defacement and social engineering against legitimate users.
Affected Products
- Concrete CMS 9.0.0 through 9.5.2
- Express entity saved search preset delete dialog
- Express entity saved search preset edit dialog
Discovery Timeline
- Vulnerability reported by Yalguun Tumenkhuu (fg0x0)
- 2026-09-15 - CVE-2026-18423 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-18423
Vulnerability Analysis
The vulnerability affects the Express feature of Concrete CMS, which allows administrators to define custom data entities with saved search presets. The delete and edit dialogs for these presets accept a preset identifier from the request but fail to verify that the requesting user holds appropriate permissions on the parent Express entity. As a result, the server processes the operation using only the supplied object reference. This is a canonical Insecure Direct Object Reference pattern classified under CWE-639.
Root Cause
The root cause is missing authorization enforcement on the preset object. The application checks that the caller is authenticated and holds view permission on at least one Express entity, but does not confirm ownership of, or write permission on, the specific preset targeted by the request. Access control is therefore decoupled from the object being modified.
Attack Vector
Exploitation requires an authenticated account with view permission on any single Express entity. The attacker submits a delete or edit request against the dialog endpoint while supplying the identifier of a preset owned by another Express entity. The server executes the operation without permission validation. Renaming allows attacker-controlled text to appear in the targeted entity's interface, which supports defacement or phishing lures targeting legitimate users of that entity.
No verified public exploit code is available. See the Concrete CMS 9.5.3 Release Notes for the vendor's technical description.
Detection Methods for CVE-2026-18423
Indicators of Compromise
- Unexpected deletion of Express saved search presets in the Concrete CMS audit log with no matching administrator activity.
- Renamed presets containing unusual text, external URLs, or content inconsistent with the entity's naming conventions.
- Preset modification events performed by user accounts that do not have administrative rights on the affected Express entity.
Detection Strategies
- Review web server access logs for POST requests to Express preset delete and edit endpoints originating from low-privilege accounts.
- Correlate preset identifiers in request parameters against the Express entity ownership model to flag cross-entity references.
- Alert on high-frequency preset modification activity from a single session or IP address.
Monitoring Recommendations
- Enable Concrete CMS activity logging for Express entity operations and forward logs to a centralized SIEM.
- Baseline normal preset creation, edit, and deletion patterns per user role to surface deviations.
- Monitor for text patterns in preset names that suggest defacement or social-engineering payloads.
How to Mitigate CVE-2026-18423
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which contains the vendor fix referenced in the release notes.
- Audit existing Express saved search presets for unauthorized deletions or suspicious renames and restore from backup where necessary.
- Review Express entity permission assignments and remove unnecessary view grants held by non-administrative users.
Patch Information
The vendor addressed the issue in Concrete CMS 9.5.3. Refer to the Concrete CMS 9.5.3 Release Notes for upgrade guidance and the full list of security fixes.
Workarounds
- Restrict Express entity view permissions to trusted users until the patched version is deployed.
- Regularly back up the Concrete CMS database so that deleted saved search presets can be recovered.
- Implement a web application firewall rule to log and inspect requests to Express preset delete and edit dialog endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.