Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message… (CVE-2026-68533)
Concrete CMS versions below 9.5.3 have a vulnerability in the conversation attachment upload endpoint where files are imported into the file manager before the system checks if the user has the "Add Message Attachments" permission. This permission check occurs only after the file is stored, allowing users without permission or unauthenticated visitors in guest-posting configurations to import approved file types into the file manager.
AI Analysis
Technical Summary
In Concrete CMS versions prior to 9.5.3, the conversation attachment upload endpoint improperly imports files into the file manager before verifying the "Add Message Attachments" permission. This sequence allows users lacking the required permission or unauthenticated visitors (in guest-posting setups) to import files of allowed types into the file manager. The vulnerability is tracked as CVE-2026-68533 and has a CVSS v4.0 base score of 2.3, indicating low severity. The permission check is delayed until after the file is stored, which is the root cause of the issue.
Potential Impact
Users without the "Add Message Attachments" permission, including unauthenticated visitors in guest-posting configurations, can import files of allowed types into the file manager. This could lead to unauthorized file uploads within the CMS environment. The impact is limited by the low CVSS score and the requirement for at least low privileges or guest-posting enabled configurations.
Mitigation Recommendations
Upgrade Concrete CMS to version 9.5.3 or later where this issue is fixed. No other mitigation details are provided. Patch status is not yet confirmed in the input data, so check the vendor advisory for current remediation guidance.
Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message… (CVE-2026-68533)
Description
Concrete CMS versions below 9.5.3 have a vulnerability in the conversation attachment upload endpoint where files are imported into the file manager before the system checks if the user has the "Add Message Attachments" permission. This permission check occurs only after the file is stored, allowing users without permission or unauthenticated visitors in guest-posting configurations to import approved file types into the file manager.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Concrete CMS versions prior to 9.5.3, the conversation attachment upload endpoint improperly imports files into the file manager before verifying the "Add Message Attachments" permission. This sequence allows users lacking the required permission or unauthenticated visitors (in guest-posting setups) to import files of allowed types into the file manager. The vulnerability is tracked as CVE-2026-68533 and has a CVSS v4.0 base score of 2.3, indicating low severity. The permission check is delayed until after the file is stored, which is the root cause of the issue.
Potential Impact
Users without the "Add Message Attachments" permission, including unauthenticated visitors in guest-posting configurations, can import files of allowed types into the file manager. This could lead to unauthorized file uploads within the CMS environment. The impact is limited by the low CVSS score and the requirement for at least low privileges or guest-posting enabled configurations.
Mitigation Recommendations
Upgrade Concrete CMS to version 9.5.3 or later where this issue is fixed. No other mitigation details are provided. Patch status is not yet confirmed in the input data, so check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2vf2-cvcp-v89w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-68533"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6aaa07f455bf5e2cf5ea4797
Added to database: 09/16/2026, 03:07:32 UTC
Last enriched: 09/16/2026, 03:33:25 UTC
Last updated: 09/16/2026, 03:33:25 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.