CVE-2026-18423
- Source
- https://cve.org/CVERecord?id=CVE-2026-18423
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18423.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-18423
- Published
- 2026-09-15T19:30:13Z
- Modified
- 2026-09-23T03:46:32Z
- Severity
-
- 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres
- Details
-
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved search presets owned by Express entities for which they had no permission, and a renamed preset name was displayed back to users of the targeted entity, enabling defacement or social engineering. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Yalguun Tumenkhuu ( fg0x0 ) for reporting.
- Database specific
{ "cna_assigner": "ConcreteCMS", "cwe_ids": [ "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18423.json" }- References
Affected packages
Git / github.com/concretecms/concretecms
Affected ranges
- Type
- GIT
- Repo
- https://github.com/concretecms/concretecms
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "9.0.0" }, { "last_affected": "9.5.2" }, { "fixed": "9.5.3" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE" ] }