Concrete CMS 9 through 9.5.2 fails to perform proper authorization checks in three actions of the Boards data source dashboard controller. The actions update, update_data_source, and delete_data_source resolve a ConfiguredDataSource from an attacker-supplied identifier without confirming the requester's edit permission on the board owning that data source. The CSRF token validation is insufficient because it is tied to the action name, not the specific target object, enabling replay attacks across boards. This allows a user with edit_board_settings permission on one board to modify or delete data sources of other boards, impacting their content feeds and custom weighting configurations. The vulnerability is tracked as CVE-2026-18421 and has a CVSS v4.0 base score of 2.1.

An attacker with edit_board_settings permission on a single board can modify or permanently delete configured data sources of other boards on the site. This disrupts the affected boards' content feeds and resets their custom weighting settings. The vulnerability does not allow privilege escalation beyond the user's existing permissions but enables unauthorized modification of other boards' data sources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict edit_board_settings permissions to trusted users only and monitor for unusual modifications to board data sources. Note that the CSRF protection in place does not fully mitigate this issue due to token reuse across boards.