Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted… (CVE-2026-68535)
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the referenced file is authorized against the user's file-manager visibility. As a result, an authenticated user holding the block-add scope could store, and cause the page to render, a reference to a file that the file-manager authorization policy would otherwise reject, disclosing that file's URL and preview to the editor and to visitors of the affected page. Under public file storage, the URL and thumbnail are exposed directly; under private storage, the disclosure is limited by the permission-checked download URL. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
AI Analysis
Technical Summary
The vulnerability in Concrete CMS Area API's block-create endpoint (versions 9.2.0 to 9.5.2) arises because the block type controller's validate() method is not called on submitted data. This validate() method normally authorizes referenced files against the user's file-manager visibility. Without this validation, authenticated users with block-add scope can store references to files that should be restricted, causing the page to render these unauthorized file references. Under public file storage, the file URL and thumbnail are directly exposed; under private storage, the exposure is limited to permission-checked download URLs. The vulnerability has a CVSS v4.0 base score of 5.1, indicating medium severity.
Potential Impact
An authenticated user with block-add permissions can cause unauthorized disclosure of file URLs and previews that should be restricted by file-manager authorization policies. This can lead to information disclosure of files that the user normally cannot access. The impact includes exposure of file URLs and thumbnails to editors and visitors of affected pages. The severity is medium based on the CVSS score provided by the Concrete CMS security team.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict block-add permissions to trusted users only to minimize risk. Monitor vendor communications for updates on official patches or workarounds.
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted… (CVE-2026-68535)
Description
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the referenced file is authorized against the user's file-manager visibility. As a result, an authenticated user holding the block-add scope could store, and cause the page to render, a reference to a file that the file-manager authorization policy would otherwise reject, disclosing that file's URL and preview to the editor and to visitors of the affected page. Under public file storage, the URL and thumbnail are exposed directly; under private storage, the disclosure is limited by the permission-checked download URL. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Concrete CMS Area API's block-create endpoint (versions 9.2.0 to 9.5.2) arises because the block type controller's validate() method is not called on submitted data. This validate() method normally authorizes referenced files against the user's file-manager visibility. Without this validation, authenticated users with block-add scope can store references to files that should be restricted, causing the page to render these unauthorized file references. Under public file storage, the file URL and thumbnail are directly exposed; under private storage, the exposure is limited to permission-checked download URLs. The vulnerability has a CVSS v4.0 base score of 5.1, indicating medium severity.
Potential Impact
An authenticated user with block-add permissions can cause unauthorized disclosure of file URLs and previews that should be restricted by file-manager authorization policies. This can lead to information disclosure of files that the user normally cannot access. The impact includes exposure of file URLs and thumbnails to editors and visitors of affected pages. The severity is medium based on the CVSS score provided by the Concrete CMS security team.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict block-add permissions to trusted users only to minimize risk. Monitor vendor communications for updates on official patches or workarounds.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pcwm-p48j-jmfv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-68535"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6aa49ff555bf5e2cf5a86598
Added to database: 09/12/2026, 00:42:29 UTC
Last enriched: 09/12/2026, 00:45:49 UTC
Last updated: 09/12/2026, 00:47:06 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.