CVE-2026-18421

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_source, and delete_data_source), which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester's edit permission on the owning board. A user granted edit_board_settings on a single board was therefore able to modify or permanently delete the configured data sources of any other board on the site, halting the affected board's content feed and resetting its custom weighting. The CSRF token that guards these actions was validated but bound to the action name rather than to the target object, so a token legitimately obtained for one board could be replayed against another board's ConfiguredDataSource identifier and did not constrain access. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

• CWE-862

• https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18409The WPForms Pro plugin for WordPress is vulnerable to Stored…7.2
• CVE-2026-1841The PixelYourSite – Your smart PIXEL (TAG) & API Manager plu…7.2
• CVE-2026-18411The KARR Security System and SWDS dealer-installed automotiv…8.1
• CVE-2026-18412OpenCart extensions are uploaded as zip files with .ocmod.zi…9.1
• CVE-2026-1842HyperCloud versions 2.3.5 through 2.6.8 improperly allowed r…6.2
• CVE-2026-18420Improper input validation in the Time Series Visual Builder …8.8
• CVE-2026-18422Concrete CMS before 9.5.3 did not enforce a destination-side…6.5
• CVE-2026-18423Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure d…7.1
• CVE-2026-18424Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Req…7.1
• CVE-2026-18425Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap…2.7
• CVE-2026-18426Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-lev…6.5
• CVE-2026-18427@fastify/static before version 10.1.3 contains an incomplete…7.5