CVE-2026-68530 Overview
CVE-2026-68530 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions 9 through 9.5.2. The flaw affects several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolves a board instance directly from an attacker-supplied instance ID. It then views, refreshes, regenerates, or deletes the instance without verifying that the requester holds edit_board_settings on the parent board.
A user granted board-edit rights on one board can reach instances of any other board on the site by supplying their instance IDs. The affected actions bypass the controller's permission-checked accessor and validate only an action-scoped CSRF token, which is reusable across boards.
Critical Impact
Authenticated users with edit rights on a single board can view, refresh, regenerate, or delete instances belonging to any other board on the site.
Affected Products
- Concrete CMS 9.0 through 9.5.2
- Concrete CMS Dashboard Boards area
- Board instance details single-page controller
Discovery Timeline
- 2026-09-15 - CVE-2026-68530 published to NVD
- 2026-09-16 - Last updated in NVD database
- Reported by Winston Crooker to the Concrete CMS security team
Technical Details for CVE-2026-68530
Vulnerability Analysis
The vulnerability stems from a broken access control pattern in the Boards Dashboard controller. The instance details single-page controller exposes several actions including view, refresh, regenerate, and delete. Each of these actions resolves a board instance directly from an instance ID supplied in the request.
The controller does not call the same permission-checked accessor used by the read view. That accessor runs canEditBoardSettings on the parent board before returning the instance. The affected actions skip this check entirely and operate on any instance ID they receive.
A CSRF token is validated, but it is action-scoped. The token is bound to the action name rather than to the target board instance, so a valid token generated for one board can be replayed against instances belonging to any other board.
Root Cause
The root cause is missing authorization [CWE-862]. The controller trusts the client-supplied instance ID and omits the parent-board edit_board_settings check that gates the read view. Action-scoped CSRF tokens provide no object-level authorization because they are not bound to the target instance.
Attack Vector
An authenticated attacker requires edit rights on at least one board on the target site. The attacker enumerates or guesses board instance IDs and issues requests to the affected controller actions in the Dashboard Boards area. The controller processes view, refresh, regenerate, or delete operations against instances the attacker should not access. Exploitation is network-reachable but requires high privileges and passes the standard CSRF token check.
No verified proof-of-concept code is publicly available. Refer to the ConcreteCMS Version 9.5 Release Notes for vendor technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-68530
Indicators of Compromise
- Requests to Dashboard Boards instance actions (view, refresh, regenerate, delete) where the acting user has edit_board_settings on a different board than the target instance.
- Unexpected board instance deletions or regenerations logged in Concrete CMS audit trails.
- Repeated requests iterating through sequential or enumerated instance ID values from a single authenticated session.
Detection Strategies
- Correlate the acting user's board permissions against the parent board of each targeted instance ID in application logs.
- Alert when a single authenticated session touches instance IDs belonging to multiple distinct parent boards in a short window.
- Baseline normal per-user board instance activity and flag deviations, particularly delete and regenerate actions.
Monitoring Recommendations
- Enable verbose application logging for Dashboard controller actions in the Boards area.
- Forward Concrete CMS web server and application logs to a centralized analytics platform for cross-session correlation.
- Monitor administrative user accounts with partial board-edit rights for unusual instance-level activity.
How to Mitigate CVE-2026-68530
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which contains the vendor fix.
- Audit user assignments for edit_board_settings and remove rights from accounts that do not require board editing.
- Review recent board instance activity for unauthorized view, refresh, regenerate, or delete operations.
Patch Information
Concrete CMS addressed this issue in the 9.5.3 release. See the ConcreteCMS Version 9.5 Release Notes for the full changelog and upgrade instructions.
Workarounds
- Restrict Dashboard access to trusted administrators until the upgrade to 9.5.3 or later is complete.
- Limit the number of users granted board-edit rights to reduce the exploitable population.
- Place the Concrete CMS Dashboard behind an additional network access control such as VPN or IP allowlisting.
# Verify installed Concrete CMS version and confirm 9.5.3 or later
php concrete/bin/concrete-cms info | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
