CVE-2026-18426 Concrete CMS CVE debrief

Who should care

Defenders responsible for Concrete CMS installations, particularly those with user-generated content or forms, should assess exposure and verify authorization checks. They should prioritize verifying and restricting user access to Express Form controls, ensuring proper authorization checks are in place, and monitoring for potential stored XSS vulnerabilities.

Why it matters

Defenders should prioritize verifying and restricting user access to Express Form controls due to a low-severity vulnerability in Concrete CMS 9.0.0 through 9.5.2, which allows an authenticated user with edit access to one Express Form to add, modify, or delete controls on Express Forms they are not authorized to edit, potentially leading to stored XSS.

• Potential for unauthorized control modifications on Express Forms
• Risk of stored XSS vulnerabilities through injected controls

Technical summary

The Express Form block in Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on control-management actions, relying solely on CSRF token validation. An authenticated user with edit access to one Express Form could reuse a validly obtained token to add, modify, or delete controls on Express Forms they were not authorized to edit, potentially leading to stored XSS. The vulnerability highlights the importance of granular permission checks for control-management actions in CMS platforms.

Defensive priority

Defenders should prioritize verifying and restricting user access to Express Form controls, ensuring proper authorization checks are in place.

Recommended defensive actions

• Verify and restrict user access to Express Form controls
• Ensure proper authorization checks are in place for control-management actions
• Monitor for and address potential stored XSS vulnerabilities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by Yat Wu and given a CVSS v4.0 score of 2.0 by the Concrete CMS security team. The issue is specific to Concrete CMS versions 9.0.0 through 9.5.2 and involves the Express Form block's control-management actions. Defenders should verify the authenticity of control modifications and ensure proper authorization checks are in place.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.