CVE-2026-68526: Concrete CMS CSRF Vulnerability

CVE-2026-68526 Overview

CVE-2026-68526 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Concrete CMS versions prior to 9.5.3. The flaw resides in the calendar event duplicate dialog controller at concrete/controllers/dialog/event/duplicate.php. The controller's submit() action fails to validate an anti-CSRF token before duplicating calendar events. It only checks canAccess() and the per-resource canAddCalendarEvent() permission. An attacker who lures an authenticated user with add-event permission to a crafted page can trigger duplicate CalendarEvents and CalendarEventVersions records created under that user's authority.

Critical Impact
Cross-site requests can force authenticated Concrete CMS users to duplicate calendar events without consent, resulting in unauthorized data creation and integrity impact on calendar resources.

Affected Products

Concrete CMS versions prior to 9.5.3
concrete/controllers/dialog/event/duplicate.php controller component
Calendar event functionality exposed to authenticated users with add-event permission

Discovery Timeline

Vulnerability reported by Winston Crooker to the Concrete CMS security team
2026-09-11 - CVE-2026-68526 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-68526

Vulnerability Analysis

The vulnerability is a classic missing CSRF token validation in a state-changing controller action. The submit() method in concrete/controllers/dialog/event/duplicate.php performs authorization checks with canAccess() and canAddCalendarEvent() but omits the anti-CSRF token check that Concrete CMS applies elsewhere. Because browsers automatically attach session cookies to cross-origin requests, any authenticated user with the required permission can be coerced into submitting the duplicate action by simply visiting an attacker-controlled page. The action then creates new CalendarEvents and CalendarEventVersions records with the victim as the acting principal.

Root Cause

The root cause is missing anti-CSRF token validation in a state-changing endpoint. Concrete CMS relies on per-request tokens to bind requests to the user's session. The duplicate dialog controller did not enforce this check, treating permission grants as sufficient. Authorization alone does not defend against forged requests that ride an authenticated session.

Attack Vector

Exploitation requires network access, no attacker privileges, and user interaction from the victim. An attacker crafts a malicious HTML page or email containing an auto-submitting form or image tag that issues a request to the victim's Concrete CMS instance. When an authenticated user with add-event permission visits the page, the browser sends the request with the user's session cookies. The server duplicates the specified calendar event without additional confirmation. Impact is limited to integrity of calendar data; confidentiality and availability are not directly affected.

No proof-of-concept code has been published. See the ConcreteCMS Version 9.5 Release Notes for the vendor's technical description of the fix.

Detection Methods for CVE-2026-68526

Indicators of Compromise

Unexpected CalendarEvents and CalendarEventVersions records created by legitimate users at unusual times or in bulk
HTTP POST requests to the calendar event duplicate dialog endpoint originating with a Referer header pointing to an external or unexpected domain
Access log entries showing repeated duplicate-event submissions without corresponding page navigation from the CMS dashboard

Detection Strategies

Review web server and application logs for POST requests to controllers under concrete/controllers/dialog/event/duplicate.php and correlate with the originating Referer and Origin headers
Audit the database for duplicate calendar event records created within short time windows by the same user account
Enable and inspect Concrete CMS audit logs for event creation actions tied to user sessions active on external domains

Monitoring Recommendations

Alert on high-volume calendar event duplication activity per user within short intervals
Monitor for HTTP requests to Concrete CMS dialog controllers missing expected CSRF token parameters
Baseline normal calendar management activity and flag deviations, particularly outside of business hours

How to Mitigate CVE-2026-68526

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which adds anti-CSRF token validation to the duplicate event submit action
Review recent calendar event creation activity for unauthorized duplicates and remove any records created through forged requests
Restrict add-event permissions to the minimum set of users required for business operations

Patch Information

Concrete CMS addressed this vulnerability in release 9.5.3. Details are documented in the ConcreteCMS Version 9.5.3 Release Notes. Administrators should apply the vendor-supplied update through the standard Concrete CMS upgrade process.

Workarounds

Deploy a Web Application Firewall (WAF) rule that enforces same-origin Origin and Referer headers on POST requests to /ccm/system/dialogs/event/duplicate/submit and related dialog endpoints
Temporarily revoke the add-event calendar permission from non-essential accounts until the patch is applied
Instruct privileged users to log out of the Concrete CMS admin interface when not actively working and to avoid browsing untrusted sites in the same browser session

bash

# Example WAF rule enforcing same-origin submissions to the duplicate dialog
# ModSecurity pseudo-rule
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1026685260,msg:'CVE-2026-68526 CSRF protection'"
SecRule REQUEST_URI "@contains /dialogs/event/duplicate" "chain"
SecRule REQUEST_HEADERS:Origin "!@beginsWith https://your-concretecms-domain.example"