CVE-2026-81916: Concrete CMS Auth Bypass Vulnerability

CVE-2026-81916 Overview

CVE-2026-81916 is an authorization flaw in Concrete CMS versions prior to 9.5.3. The dashboard submit route for Express entries validated permissions against the entity referenced in the posted form rather than the entity identified by the route ID. An authenticated user with rights to add entries to one Express object could submit entries to a different Express object outside their authorization scope. Successful exploitation can pollute protected datasets, trigger unintended workflows, or inject content into administrative processes. The issue is tracked under [CWE-639] Authorization Bypass Through User-Controlled Key. Yonatan Drori from Tenzai is credited with reporting the vulnerability.

Critical Impact

Authenticated attackers with high privileges on one Express object can write entries to unrelated Express objects, corrupting protected data and triggering downstream workflows.

Affected Products

• Concrete CMS versions before 9.5.3
• Concrete CMS Express entry submission component
• Dashboard route handler for Express entities

Discovery Timeline

• 2026-09-11 - CVE-2026-81916 published to NVD
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-81916

Vulnerability Analysis

The vulnerability resides in the dashboard submission handler for Concrete CMS Express entries. Concrete CMS Express is a data modeling feature that allows administrators to define custom entities and forms. The submit route resolved the target Express entity from the attacker-controlled route identifier, while the authorization check evaluated permissions against a separate entity value posted inside the form body. Because the code path never compared the two entities, a user authorized to write to Entity A could target the submission at Entity B by manipulating the route.

The flaw represents a classic insecure direct object reference where the authorization decision and the object operated upon diverge. Impacted deployments risk data pollution in Express-backed datasets, unauthorized invocation of Express workflows, and content injection into administrative pipelines that consume Express data.

Root Cause

The root cause is inconsistent entity resolution between the permission check and the write operation. The permission subsystem trusted the form-supplied entity identifier, while the persistence layer used the route-derived entity identifier. No equality check enforced that both identifiers referenced the same Express object, breaking the authorization contract.

Attack Vector

Exploitation requires an authenticated session with high privileges on at least one Express object. The attacker submits a crafted request to the dashboard Express submit endpoint. The route path targets an Express object outside the attacker's scope, while the request body references an Express object the attacker is permitted to modify. The server passes the permission check on the form-supplied entity and then writes the entry against the route-supplied entity. No user interaction is required beyond the attacker's own authenticated request.

See the Concrete CMS 9.5.3 Release Notes for the vendor's technical description of the fix.

Detection Methods for CVE-2026-81916

Indicators of Compromise

• Dashboard POST requests to Express submit routes where the route Express entity ID differs from the entity ID present in the form body.
• Unexpected new entries in Express objects owned by administrators or restricted user groups.
• Workflow executions triggered by Express submissions from user accounts that lack visible permissions on the target Express object.

Detection Strategies

• Enable verbose logging on the Concrete CMS dashboard controllers and diff the route-derived and form-derived Express entity identifiers per request.
• Audit Express entry creation events and correlate the submitting user's group permissions against the target Express object's access control list.
• Baseline normal Express entry submission volume per user and alert on anomalous writes into administrative Express objects.

Monitoring Recommendations

• Forward Concrete CMS application and web server logs to a centralized log platform for retention and query.
• Monitor changes to Express datasets that feed administrative workflows or reporting pipelines.
• Review user role assignments and Express object permissions on a recurring cadence to reduce the pool of high-privilege accounts.

How to Mitigate CVE-2026-81916

Immediate Actions Required

• Upgrade Concrete CMS to version 9.5.3 or later on all production and staging instances.
• Inventory Express objects and verify that recent entries were created by authorized users only.
• Reduce the number of accounts with add entry permissions on any Express object to the minimum required.

Patch Information

Concrete CMS resolved the flaw in version 9.5.3. The fix ensures the dashboard submit route compares the route-identified Express entity against the form-supplied entity before persisting the entry. Refer to the Concrete CMS 9.5.3 Release Notes for the full changelog and upgrade guidance.

Workarounds

• Restrict dashboard access to trusted administrators until the upgrade to 9.5.3 is completed.
• Temporarily disable non-essential Express objects that trigger sensitive workflows or feed administrative processes.
• Apply web application firewall rules that reject Express submit requests where the route entity identifier and the form entity identifier do not match.

# Example WAF rule concept for mismatched Express entity identifiers
# Block dashboard Express submissions when route ID != posted entity ID
SecRule REQUEST_URI "@rx /dashboard/express/entries/[0-9]+/submit" \
  "id:1029161,phase:2,deny,status:403,\
   chain,msg:'Concrete CMS CVE-2026-81916 Express entity mismatch'"
  SecRule ARGS:entity_id "!@streq %{TX.route_entity_id}"