Concrete CMS versions 9 through 9.5.2 have an authorization bypass vulnerability in the Boards data source dashboard controller. Three actions (update, update_data_source, and delete_data_source) do not verify if the requester has permission to edit the owning board before modifying or deleting configured data sources. Although a CSRF token is required, it is bound to the action name rather than the target object, allowing token reuse across different boards. This flaw allows users with edit_board_settings permission on one board to affect other boards' data sources, disrupting content feeds and resetting custom settings.