CVE-2026-87028 Concrete CMS CVE debrief

Who should care

Concrete CMS administrators, users with edit-board-contents permission, security teams responsible for access control and information disclosure, and operators managing Concrete CMS deployments. They should assess exposure, prioritize remediation, and verify user permissions to prevent potential information disclosure.

Why it matters

CVE-2026-87028 is a medium-severity vulnerability in Concrete CMS that allows authenticated users to access sensitive information without proper authorization. Defenders should assess exposure, prioritize remediation, and verify user permissions to prevent potential information disclosure.

• Potential unauthorized information disclosure
• Need to verify user permissions and access controls
• Possible exploitation by authenticated users

Technical summary

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit. An authenticated user holding edit-board-contents permission on a single board instance could submit the identifier of an item belonging to a different board instance and receive summary fields, including the page title and description, of an underlying page the same user was otherwise forbidden to view.

Defensive priority

Medium priority for Concrete CMS administrators to restrict access and verify user permissions

Recommended defensive actions

• Verify user permissions and access controls for Concrete CMS board instances
• Restrict access to sensitive information and pages
• Update to a fixed version of Concrete CMS if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its impact, and affected versions. The vulnerability allows authenticated users to access sensitive information without proper authorization. Defenders should assess exposure, prioritize remediation, and verify user permissions to prevent potential information disclosure. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3. The vulnerability affects Concrete CMS 9 through 9.5.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.