CVE-2026-68535 Overview
CVE-2026-68535 is a missing authorization vulnerability [CWE-862] in the Concrete CMS Area API's block-create endpoint. The flaw affects versions 9.2.0 through 9.5.2. The endpoint does not invoke the block type controller's validate() method on submitted data. For file-referencing blocks such as hero_image and gallery, this method enforces file-manager visibility. An authenticated user with the block-add scope can reference a file that the authorization policy would otherwise reject, disclosing the file's URL and preview.
Critical Impact
Authenticated editors can disclose file URLs and thumbnails that the file-manager authorization policy would normally block, exposing restricted content to page visitors.
Affected Products
- Concrete CMS 9.2.0 through 9.5.2
- Concrete CMS Area API block-create endpoint
- File-referencing block types including hero_image and gallery
Discovery Timeline
- 2026-09-11 - CVE-2026-68535 published to the National Vulnerability Database
- 2026-09-15 - Last updated in NVD database
- Reported by researcher riodrwn per the vendor advisory
Technical Details for CVE-2026-68535
Vulnerability Analysis
The Concrete CMS Area API exposes a block-create endpoint used by editors to add blocks to a page. Blocks that reference files, such as hero_image and gallery, rely on their controller's validate() method to enforce file-manager visibility. This check confirms the acting user can see the referenced file according to the site's authorization policy.
The block-create endpoint skips this validation step. As a result, an authenticated user holding the block-add scope can submit a file identifier that they should not be able to see. The block is stored and rendered, disclosing the file to page editors and site visitors.
Under public file storage, the URL and thumbnail are exposed directly. Under private storage, disclosure is limited to the permission-checked download URL. The vendor scored this issue 5.1 on CVSS v4.0.
Root Cause
The root cause is a missing authorization check [CWE-862] in the API layer. The Area API path constructs and persists the block without dispatching to the block type controller's validate() routine. Authorization for file references lives inside that routine, so bypassing it removes the file-manager visibility enforcement for every file-referencing block type.
Attack Vector
Exploitation requires an authenticated account with the block-add scope on a target Area. The attacker submits a crafted block-create request that references a private file identifier belonging to another scope. The server stores the reference and renders the block, returning the file's URL and preview to any user who views the page. No user interaction is required beyond the initial authenticated request.
No verified public exploit code is available. See the ConcreteCMS Version 9.5 Release Notes for the fix description.
Detection Methods for CVE-2026-68535
Indicators of Compromise
- Unexpected hero_image, gallery, or other file-referencing blocks created by editor accounts on pages they do not typically manage.
- Requests to the Area API block-create endpoint referencing file IDs that fall outside the requesting user's file-manager visibility.
- Page renders that surface file URLs or thumbnails not previously exposed on public pages.
Detection Strategies
- Audit the Concrete CMS Blocks and FileVersions tables for block records whose referenced file is not visible to the block's creator under current file-manager permissions.
- Correlate application logs for block-create API calls with the acting user's file-manager scope to flag mismatches.
- Review web server access logs for anomalous fetches of preview or download URLs for private files following block creation events.
Monitoring Recommendations
- Enable verbose logging on the Area API and forward it to a centralized log platform for retention and search.
- Alert on new block creations by low-privilege editor accounts across multiple pages in a short window.
- Track outbound requests for file thumbnails and download URLs tied to files marked private in the file manager.
How to Mitigate CVE-2026-68535
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which restores the validate() call in the block-create workflow.
- Inventory accounts holding the block-add scope and remove the privilege from users who do not require it.
- Review recently created file-referencing blocks and remove any that reference files outside the creator's file-manager visibility.
Patch Information
The Concrete CMS security team addressed this vulnerability in the 9.5.3 release. Details are documented in the ConcreteCMS Version 9.5 Release Notes. Upgrading from any release in the 9.2.0 to 9.5.2 range remediates the missing authorization check.
Workarounds
- Move sensitive assets to private file storage so disclosure is limited to permission-checked download URLs rather than direct public URLs and thumbnails.
- Restrict use of file-referencing block types such as hero_image and gallery to trusted editor roles until the patch is applied.
- Apply web application firewall rules that inspect block-create API payloads and block references to file IDs outside the caller's file-manager scope.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
