Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. (CVE-2026-68529)
Concrete CMS versions 9.0.0 through 9.5.2 contain a vulnerability where an authorization check is missing on the Express entries advanced-search dashboard action. This allows an authenticated dashboard user with permission to view entries of one Express entity to access entries of other entities without proper permission checks. The flaw exposes potentially sensitive form submissions and CRM-style records across entity permission boundaries. The vulnerability has been assigned CVE-2026-68529 and a CVSS v4.0 score of 2.1, indicating low severity.
AI Analysis
Technical Summary
Concrete CMS 9.0.0 through 9.5.2 lacks an authorization check in the advanced_search() method of DashboardSelectableExpressEntryListTrait. This method resolves an Express entity directly from a user-supplied entity ID and renders entries without invoking the canViewExpressEntries() permission check that is enforced in the sibling results() action. Consequently, an authenticated dashboard user with view_express_entries permission on a single Express entity can read entries of any other entity by specifying that entity's ID in the advanced-search action, bypassing intended per-entity permission boundaries.
Potential Impact
An authenticated dashboard user with permission to view entries on one Express entity can access entries, including secret attribute values, of any other Express entity. This leads to unauthorized disclosure of form submissions and CRM-style records across entities, violating the intended per-entity access control model. The impact is limited to authenticated users with elevated dashboard permissions and is rated as low severity by the vendor.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict dashboard user permissions to minimize exposure. Monitor vendor communications for updates on patches or official fixes.
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. (CVE-2026-68529)
Description
Concrete CMS versions 9.0.0 through 9.5.2 contain a vulnerability where an authorization check is missing on the Express entries advanced-search dashboard action. This allows an authenticated dashboard user with permission to view entries of one Express entity to access entries of other entities without proper permission checks. The flaw exposes potentially sensitive form submissions and CRM-style records across entity permission boundaries. The vulnerability has been assigned CVE-2026-68529 and a CVSS v4.0 score of 2.1, indicating low severity.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS 9.0.0 through 9.5.2 lacks an authorization check in the advanced_search() method of DashboardSelectableExpressEntryListTrait. This method resolves an Express entity directly from a user-supplied entity ID and renders entries without invoking the canViewExpressEntries() permission check that is enforced in the sibling results() action. Consequently, an authenticated dashboard user with view_express_entries permission on a single Express entity can read entries of any other entity by specifying that entity's ID in the advanced-search action, bypassing intended per-entity permission boundaries.
Potential Impact
An authenticated dashboard user with permission to view entries on one Express entity can access entries, including secret attribute values, of any other Express entity. This leads to unauthorized disclosure of form submissions and CRM-style records across entities, violating the intended per-entity access control model. The impact is limited to authenticated users with elevated dashboard permissions and is rated as low severity by the vendor.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict dashboard user permissions to minimize exposure. Monitor vendor communications for updates on patches or official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8c52-2cf7-cm2c
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-68529"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6aaa07f255bf5e2cf5ea435c
Added to database: 09/16/2026, 03:07:30 UTC
Last enriched: 09/16/2026, 03:33:40 UTC
Last updated: 09/16/2026, 03:33:40 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.