EUVD-2026-76687
GHSA-7vpf-4c24-4xfv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, low-complexity exploit requiring only low-privilege Express entry permission; integrity-only impact with no scope change.
Primary rating from Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de).
CVSS VectorVendor: ff5b8ace-8b95-4078-9743-eac1ca5451de
Lifecycle Timeline
2DescriptionCVE.org
Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Express object outside their authorization scope, potentially polluting protected datasets, triggering workflows, or injecting content into administrative processes. The dashboard submit route resolved the mutated entity from the attacker-controlled route ID while the permission check validated the independently posted form's entity, and the submission proceeded because the two entities were never compared. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
AnalysisAI
Broken access control in Concrete CMS before 9.5.3 allows authenticated users with limited Express entry permissions to inject entries into Express objects they are not authorized to modify. The vulnerability stems from a parameter confusion bug where the permission check validates the entity supplied in the POST body, but the dashboard submit route resolves the actual target entity from an attacker-controlled route ID - and the two are never compared. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session holding at least add-entry permissions on one Express object - this is the minimum viable privilege. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 5.1 (PR:H) reflects a medium-severity integrity issue with no confidentiality or availability dimension, which is broadly consistent with the impact described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Concrete CMS to version 9.5.3 or later, which resolves the entity comparison gap in the Express submission route. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today