Concrete CMS versions 9.0.0 through 9.5.2 contain a vulnerability where an authorization check is missing on the Express entries advanced-search dashboard action. This allows an authenticated dashboard user with permission to view entries of one Express entity to access entries of other entities without proper permission checks. The flaw exposes potentially sensitive form submissions and CRM-style records across entity permission boundaries. The vulnerability has been assigned CVE-2026-68529 and a CVSS v4.0 score of 2.1, indicating low severity.