Threats Tagged 'cve-2026-18426'

Concrete CMS versions 9.0.0 through 9.5.2 have a vulnerability where the Express Form block's control-management actions do not enforce block-level edit-permission checks. Instead, they rely solely on CSRF token validation, which is bound to the user and action but not to specific blocks, pages, or forms. This allows an authenticated user with edit access to one Express Form to reuse a valid token to modify controls on other Express Forms they should not have permission to edit, potentially injecting controls that lead to stored cross-site scripting (XSS). The vulnerability has a low CVSS v4.0 score of 2.0. No known exploits are reported in the wild, and no patch information is provided.