CVE-2026-18423CWE-639

CVE-2026-18423

High · published September 16, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved search presets owned by Express entities for which they had no permission, and a renamed preset name was displayed back to users of the targeted entity, enabling defacement or social engineering. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Yalguun Tumenkhuu ( fg0x0 ) for reporting.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
2.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-16T00:17Z
Affected products (1)
ProductVersionsFixed in
concretecms/concrete_cms≥ 9.0.0, < 9.5.39.5.3
References (1)
https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes · ff5b8ace-8b95-4078-9743-eac1ca5451de
EPSS history
Timeline
  • 17 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 15 SEP 19:30Z
    Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres
    cvelistv5