In Concrete CMS prior to version 9.5.3, the authorization check for Express entry submissions was performed against the entity of the posted form instead of the entity identified by the dashboard route. This mismatch allowed a user authorized to add entries to one Express object to submit entries to a different Express object outside their permission scope. The dashboard submit route resolved the entity from an attacker-controlled route ID, while the permission check validated the independently posted form's entity, and since these two entities were never compared, unauthorized submissions could proceed. This vulnerability is tracked as CVE-2026-81916 and was reported by Yonatan Drori from Tenzai. The Concrete CMS security team assigned it a CVSS v4.0 score of 5.1.

An attacker with permission to add entries to one Express object can create entries in other Express objects without authorization. This can lead to unauthorized data pollution, unintended triggering of workflows, and injection of content into administrative processes, potentially compromising data integrity and operational workflows within Concrete CMS.

A fix is available in Concrete CMS version 9.5.3. Users should upgrade to version 9.5.3 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary as the vulnerability is addressed by the official fix.