Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. (CVE-2026-68530)
Concrete CMS versions 9 through 9.5.2 have an authorization bypass vulnerability in the Boards area of the Dashboard. The system did not verify that a user had the required edit_board_settings permission on a board's parent before allowing actions on board instances. This allowed users with board-edit rights on one board to perform actions on instances of other boards by supplying their instance IDs. The vulnerability is due to the reuse of a CSRF token that is bound to the action name rather than the target object, bypassing proper permission checks.
AI Analysis
Technical Summary
Concrete CMS 9 through 9.5.2 failed to perform proper authorization checks on several board-instance actions within the Dashboard's Boards area. The instance details controller resolved board instances directly from attacker-supplied instance IDs and allowed viewing, refreshing, regenerating, or deleting these instances without verifying that the requester had edit_board_settings permission on the parent board. The affected actions bypassed the permission-checked accessor and relied solely on an action-scoped CSRF token, which is reusable across boards and not bound to the specific target object. This flaw enables a user with board-edit rights on one board to access and manipulate instances of other boards on the site.
Potential Impact
Users with board-edit permissions on a single board can access and perform actions on instances of other boards without proper authorization. This could lead to unauthorized viewing, refreshing, regenerating, or deletion of board instances. The CVSS v4.0 score assigned by the Concrete CMS security team is 2.1, indicating a low severity impact. There is no indication of remote code execution or privilege escalation beyond the board instance scope.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict board-edit permissions carefully to trusted users only. Monitor vendor channels for updates and apply official patches once released.
Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. (CVE-2026-68530)
Description
Concrete CMS versions 9 through 9.5.2 have an authorization bypass vulnerability in the Boards area of the Dashboard. The system did not verify that a user had the required edit_board_settings permission on a board's parent before allowing actions on board instances. This allowed users with board-edit rights on one board to perform actions on instances of other boards by supplying their instance IDs. The vulnerability is due to the reuse of a CSRF token that is bound to the action name rather than the target object, bypassing proper permission checks.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS 9 through 9.5.2 failed to perform proper authorization checks on several board-instance actions within the Dashboard's Boards area. The instance details controller resolved board instances directly from attacker-supplied instance IDs and allowed viewing, refreshing, regenerating, or deleting these instances without verifying that the requester had edit_board_settings permission on the parent board. The affected actions bypassed the permission-checked accessor and relied solely on an action-scoped CSRF token, which is reusable across boards and not bound to the specific target object. This flaw enables a user with board-edit rights on one board to access and manipulate instances of other boards on the site.
Potential Impact
Users with board-edit permissions on a single board can access and perform actions on instances of other boards without proper authorization. This could lead to unauthorized viewing, refreshing, regenerating, or deletion of board instances. The CVSS v4.0 score assigned by the Concrete CMS security team is 2.1, indicating a low severity impact. There is no indication of remote code execution or privilege escalation beyond the board instance scope.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict board-edit permissions carefully to trusted users only. Monitor vendor channels for updates and apply official patches once released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-58xf-6w56-p6xr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-68530"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6aaa07f455bf5e2cf5ea4794
Added to database: 09/16/2026, 03:07:32 UTC
Last enriched: 09/16/2026, 03:33:33 UTC
Last updated: 09/16/2026, 03:33:33 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.