CVE-2026-18426: Concrete CMS Auth Bypass Vulnerability

CVE-2026-18426 Overview

CVE-2026-18426 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions 9.0.0 through 9.5.2. The Express Form block's control-management actions rely solely on Cross-Site Request Forgery (CSRF) token validation and skip a block-level edit-permission check. An authenticated user holding edit access to any single Express Form can reuse a valid token to add, modify, or delete controls on Express Forms they do not own. An attacker can inject a control whose value renders as HTML, producing stored Cross-Site Scripting (XSS). The Concrete CMS security team assigned a CVSS v4.0 score of 2.0, reflecting the high privileges and user interaction required for exploitation.

Critical Impact
Authenticated users with edit access to one Express Form can tamper with controls on unrelated forms and stage stored XSS against other users of the site.

Affected Products

Concrete CMS 9.0.0 through 9.5.2
Express Form block control-management actions
Sites permitting multiple users with block-edit privileges

Discovery Timeline

2026-09-15 - CVE-2026-18426 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18426

Vulnerability Analysis

The Express Form block exposes control-management endpoints that allow authenticated users to add, edit, or delete form controls. These endpoints validate a CSRF token but do not verify whether the requesting user holds edit permission on the specific block, page, or form being changed. Because the token is bound to the user and the action rather than to a specific target object, any authenticated user who legitimately obtains a token for one Express Form can replay it against a different Express Form. The result is an authorization bypass that enables horizontal privilege escalation across form instances.

Root Cause

The defect is a missing authorization check [CWE-862] in the Express Form control-management handlers. The application treats CSRF token validity as sufficient proof of intent and identity, conflating request authenticity with access control. No per-object permission lookup runs before mutations are persisted.

Attack Vector

Exploitation requires an authenticated account with edit rights on at least one Express Form and a victim who interacts with the tampered form. The attacker submits control-management requests bearing a valid CSRF token but targeting form identifiers they do not own. Injected control definitions may include payloads that Concrete CMS later renders as HTML, producing stored XSS against site visitors or administrators who view the affected form. See the Concrete CMS 9.5.3 Release Notes for the vendor's fix description.

Detection Methods for CVE-2026-18426

Indicators of Compromise

Express Form controls containing HTML tags, <script> fragments, or on* event handler attributes in stored values.
Audit records showing form-control modifications performed by users who lack edit permission on the target form.
Unexpected changes to production Express Forms shortly after low-privilege user activity.

Detection Strategies

Review Concrete CMS activity logs for express and block control-management actions and correlate the acting user against the target form's permission set.
Query the database for Express Form control labels and default values containing HTML or JavaScript syntax.
Alert on any editorial user whose form modifications span multiple form owners in a short window.

Monitoring Recommendations

Forward Concrete CMS application and web server logs to a centralized log platform for retention and correlation.
Monitor HTTP POST requests to Express Form control-management routes and flag anomalous form identifier access patterns.
Track stored XSS indicators by scanning rendered form output for script-bearing content on a scheduled basis.

How to Mitigate CVE-2026-18426

Immediate Actions Required

Upgrade Concrete CMS to a version later than 9.5.2 that includes the block-level permission check for Express Form control management.
Audit existing Express Form controls for injected HTML or script payloads and remove suspicious entries.
Review user and group permissions and remove edit rights from accounts that do not require them.

Patch Information

Concrete CMS addressed the missing authorization check in the 9.5.3 release. Refer to the Concrete CMS 9.5.3 Release Notes for upgrade instructions and the complete list of security fixes.

Workarounds

Restrict Express Form edit permissions to a minimal set of trusted users until the patched release is deployed.
Enable a Content Security Policy (CSP) that blocks inline scripts to reduce the impact of stored XSS payloads.
Sanitize existing Express Form control values by stripping HTML tags before rendering pages that contain user-editable forms.

bash

# Configuration example: verify the installed Concrete CMS version
grep -R "APP_VERSION" concrete/config/concrete.php

# Example CSP header to mitigate stored XSS in Express Forms
# Set via web server configuration (Apache/Nginx)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"