Concrete CMS versions 9 through 9.5.2 have an authorization bypass vulnerability in the Boards area of the Dashboard. The system did not verify that a user had the required edit_board_settings permission on a board's parent before allowing actions on board instances. This allowed users with board-edit rights on one board to perform actions on instances of other boards by supplying their instance IDs. The vulnerability is due to the reuse of a CSRF token that is bound to the action name rather than the target object, bypassing proper permission checks.