Concrete CMS versions 9.0.0 through 9.5.2 lack proper enforcement of block-level edit-permission checks on the Express Form block's control-management actions. The system relies only on CSRF token validation, which is user- and action-bound but not tied to specific blocks or forms. This flaw enables an authenticated user with edit rights on one Express Form to reuse a CSRF token to add, modify, or delete controls on other Express Forms without authorization. Such unauthorized modifications can include injecting controls whose values are rendered as HTML, leading to stored XSS vulnerabilities. The issue is tracked as CVE-2026-18426 and has a CVSS v4.0 score of 2.0, indicating low severity.

An authenticated user with edit access to one Express Form block can manipulate controls on other Express Forms they are not authorized to edit by reusing CSRF tokens. This can lead to unauthorized addition, modification, or deletion of form controls, including injection of malicious HTML content resulting in stored cross-site scripting (XSS). The impact is limited by the requirement for authenticated edit access and the low CVSS score reflects the limited scope and complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict edit permissions to trusted users only and monitor for unusual form control changes. Avoid reusing CSRF tokens across different blocks or forms if possible. Follow official Concrete CMS security updates for any released patches or workarounds.