CVE-2026-68529 Overview
CVE-2026-68529 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions 9.0.0 through 9.5.2. The flaw resides in the Express entries advanced-search dashboard action, which fails to enforce per-entity permission checks. An authenticated dashboard user who holds view_express_entries on a single Express entity can read the entries of any other Express entity by supplying that entity's ID to the advanced-search action. Disclosed data includes form submissions, CRM-style records, and secret attribute values across the per-entity permission boundary that Express is designed to enforce.
Critical Impact
Authenticated dashboard users can bypass Express per-entity authorization to read arbitrary Express entity entries, exposing form submissions and CRM records.
Affected Products
- Concrete CMS 9.0.0 through 9.5.2
- Concrete CMS Express entries dashboard (DashboardSelectableExpressEntryListTrait)
- Concrete CMS advanced-search dashboard action
Discovery Timeline
- Vulnerability reported by Winston Crooker to the Concrete CMS security team
- 2026-09-15 - CVE-2026-68529 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-68529
Vulnerability Analysis
The vulnerability sits in the advanced_search() method of DashboardSelectableExpressEntryListTrait. This method resolves an Express entity directly from a user-supplied entity ID and renders that entity's entries. The sibling results() action calls canViewExpressEntries() to enforce a per-entity permission check before returning data. The advanced_search() action omits this check, so authorization is decided only by whether the caller can reach the dashboard route at all.
Express in Concrete CMS is used to build custom data structures such as contact forms, CRM records, and structured submissions. Each entity carries its own access-control list. Bypassing that ACL discloses records that administrators expect to be siloed per entity, including attribute values marked as secret.
Root Cause
The root cause is a missing authorization check [CWE-862]. The advanced_search() handler trusts the entity ID supplied in the request and skips the canViewExpressEntries() guard that governs Express entry reads elsewhere in the codebase. Authorization logic exists in the framework but is not invoked on this code path.
Attack Vector
Exploitation requires an authenticated dashboard session with view_express_entries on at least one Express entity. The attacker requests the advanced-search dashboard action and substitutes the target entity's ID. The handler resolves the target entity, skips the permission check, and returns its entries. No user interaction from a victim is required, and no elevated privileges beyond a low-tier Express permission are needed.
Because the flaw is a missing check rather than a memory or parsing bug, no exploitation code is required beyond a crafted dashboard request. See the ConcreteCMS Version 9.5.3 Release Notes for the vendor's fix description.
Detection Methods for CVE-2026-68529
Indicators of Compromise
- Dashboard access logs showing requests to the Express advanced-search action referencing entity IDs the requesting user is not explicitly granted view_express_entries on.
- Repeated advanced-search requests iterating through sequential or enumerated Express entity IDs from a single authenticated session.
- Application logs showing Express entry reads that lack a corresponding canViewExpressEntries() authorization event.
Detection Strategies
- Correlate authenticated dashboard sessions against their assigned Express entity permissions and flag advanced-search requests targeting unauthorized entity IDs.
- Baseline normal Express dashboard usage per account and alert on volume spikes or entity-ID enumeration patterns.
- Review web server access logs for requests to the advanced-search dashboard route from accounts that do not administer Express.
Monitoring Recommendations
- Enable verbose logging on Concrete CMS dashboard controllers and forward access records to a centralized log platform.
- Monitor Express entry exports and record views for anomalous access patterns following authentication events.
- Track privilege assignments to view_express_entries and alert on changes to Express entity ACLs.
How to Mitigate CVE-2026-68529
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which restores the per-entity permission check on the advanced-search action.
- Audit accounts holding view_express_entries on any Express entity and remove permissions that are not operationally required.
- Review Express entries containing sensitive data such as CRM records and form submissions for unauthorized access since installation of an affected version.
Patch Information
Concrete CMS addressed the missing authorization in the 9.5.3 release. The fix invokes canViewExpressEntries() in the advanced_search() method of DashboardSelectableExpressEntryListTrait, matching the check already enforced by the sibling results() action. Details are published in the ConcreteCMS Version 9.5.3 Release Notes.
Workarounds
- Restrict dashboard access to trusted administrators until the 9.5.3 upgrade is applied.
- Remove view_express_entries grants from non-administrative roles to shrink the pool of accounts that meet the exploitation precondition.
- Segment sensitive Express entities into instances that only trusted administrators can reach through the dashboard.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.