Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• concretecms concrete cmsbefore 9.5.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (ConcreteCMS). Independent of NVD's CPE analysis and usually ahead of it.

• Concrete CMS Concrete CMS

  • 5.0 and later · up to and including 9.5.0affected · git

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-6826Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller
  60This week
• CVE-2022-21829Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which c
  40Plan
• CVE-2023-48648Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions.
  39Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-8435May 21, 2026 · Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()
  9Monitor
• ← EarlierCVE-2026-8340May 22, 2026 · Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion
  9Monitor
• Later →CVE-2026-8353May 22, 2026 · Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme
  8Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const invoice = await Invoice.findById(req.params.id);2res.json(invoice);

1const invoice = await Invoice.findOne({2  id: req.params.id,3  ownerId: req.user.id,4});5if (!invoice) return res.sendStatus(404);6res.json(invoice);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.