CVE-2026-87028: Concrete CMS Auth Bypass Vulnerability

CVE-2026-87028 Overview

CVE-2026-87028 is a broken access control vulnerability in Concrete CMS versions 9 through 9.5.3. The flaw resides in the custom-slot preview endpoint used by the board editor. The endpoint fails to confirm that a submitted InstanceItem belongs to the board instance the requesting user is authorized to edit. It also skips page-view permission checks before generating page-backed summary content. An authenticated user with edit-board-contents permission on one board instance can retrieve summary fields, including the page title and description, of pages they are otherwise forbidden to view. The issue is classified as Missing Authorization [CWE-862].

Critical Impact
Authenticated attackers with edit-board-contents rights on any single board instance can enumerate and read summary content from restricted pages across the site.

Affected Products

Concrete CMS 9.0 through 9.5.3
Concrete CMS board editor custom-slot preview endpoint
Fixed in Concrete CMS 9.5.4

Discovery Timeline

Vulnerability reported by Pakung to the Concrete CMS security team
2026-09-16 - CVE-2026-87028 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87028

Vulnerability Analysis

The vulnerability exists in the Concrete CMS board custom-slot preview workflow. When a user edits a board, the editor calls a preview endpoint to render summary content for a given board InstanceItem. The endpoint accepts an item identifier from the client and returns rendered summary fields. Two authorization checks are missing from this flow. First, the server does not verify that the submitted InstanceItem belongs to the board instance the user has permission to edit. Second, the server does not enforce page-view permission on the underlying page before generating page-backed summary output. The combined result is an authorization gap that discloses restricted page metadata to lower-privileged users.

Root Cause

The root cause is missing authorization enforcement [CWE-862] at two layers. The preview endpoint trusts the client-supplied item identifier without cross-checking board instance ownership. The summary generator then reads the linked page and returns its title and description without invoking the page-level permission checker. Neither layer independently confirms that the requesting user should see the target resource.

Attack Vector

An attacker must hold a valid account with edit-board-contents permission on at least one board instance. The attacker enumerates or guesses InstanceItem identifiers belonging to other board instances. The attacker submits those identifiers to the custom-slot preview endpoint over the network. The server responds with summary fields, including the page title and description, of the underlying pages. This exposes information from pages the attacker is not authorized to view. No user interaction and no elevated privileges beyond the low-privileged editor role are required.

No verified proof-of-concept code is publicly available. See the ConcreteCMS Version 9.54 Release Notes for vendor technical details.

Detection Methods for CVE-2026-87028

Indicators of Compromise

Repeated POST requests from a single authenticated session to the board custom-slot preview endpoint with varying InstanceItem identifiers.
Preview responses returning page titles or descriptions for pages the requesting user has no direct view permission on.
Sequential or scripted enumeration patterns targeting board item identifiers within short time windows.

Detection Strategies

Correlate authenticated user identity, requested InstanceItem identifier, and the owning board instance in application logs to flag cross-instance access.
Alert when a user with only edit-board-contents on one board issues preview requests referencing item identifiers outside that board.
Baseline normal editor usage and identify volumetric anomalies against the custom-slot preview endpoint.

Monitoring Recommendations

Enable verbose application logging for the board editor endpoints and forward logs to a centralized platform for retention and search.
Monitor authorization decision logs, particularly denials and misses, for the pages module.
Track new account creation and role assignments that grant edit-board-contents on any board instance.

How to Mitigate CVE-2026-87028

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.4 or later, which contains the vendor fix.
Audit accounts that hold edit-board-contents permission and remove entitlements that are not required.
Review recent web server and application logs for anomalous access to the board custom-slot preview endpoint.

Patch Information

Concrete CMS addressed the missing authorization checks in the 9.5.4 release. The fix enforces that a submitted InstanceItem belongs to the board instance the user is authorized to edit and validates page-view permission before rendering page-backed summary output. Refer to the ConcreteCMS Version 9.54 Release Notes for the official advisory.

Workarounds

Restrict the edit-board-contents permission to a minimal set of trusted users until patching is complete.
Disable or remove board instances that are not actively used to reduce exposed identifiers.
Place the Concrete CMS administration and editor endpoints behind network access controls where feasible.

bash

# Configuration example
# Verify installed Concrete CMS version and plan upgrade to 9.5.4+
php concrete/bin/concrete5 c5:info | grep -i version