CVE-2026-68529

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries without invoking canViewExpressEntries(), the per-entity permission check that the sibling results() action enforced. An authenticated dashboard user holding view_express_entries on a single Express entity could read the entries of any other entity, including secret attribute values, by requesting the advanced-search action with that entity's ID, disclosing form submissions and CRM-style records across the per-entity permission boundary that Express is designed to enforce. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

• CWE-862

• https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-68519Glances is an open-source system cross-platform monitoring t…7.1
• CVE-2026-68520Glances is an open-source system cross-platform monitoring t…5.3
• CVE-2026-68525Incorrect Authorization vulnerability in Apache Tomcat's FOR…9.1
• CVE-2026-68526Concrete CMS before 9.5.3 did not validate an anti-CSRF toke…5.3
• CVE-2026-68527Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to …5.9
• CVE-2026-68528Concrete CMS RSS Displayer block below version 9.5.3 render…6
• CVE-2026-6853Improper restriction of excessive authentication attempts vu…9.8
• CVE-2026-68530Concrete CMS 9 through 9.5.2 did not perform an authorizatio…2.1
• CVE-2026-68531Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard…2.1
• CVE-2026-68532Concrete CMS 9.0.0 to dashboard group type controller did no…2.3
• CVE-2026-68533Concrete CMS below 9.5.3 conversation attachment uploaded en…2.3
• CVE-2026-68534Concrete CMS before 9.5.3 rendered Express entry labels as r…2.3