CVE-2026-68526

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-68526

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68526.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-68526

Published

2026-09-11T19:35:37Z

Modified

2026-09-27T03:47:34Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller

Details

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission, so a crafted cross-site request could cause an authenticated user with add-event permission to create duplicate CalendarEvents and CalendarEventVersions records under their own authority. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

Database specific

{
    "cna_assigner":  "ConcreteCMS",
    "cwe_ids":  [
        "CWE-352"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68526.json"
}

References

Affected packages

Git / github.com/concretecms/concretecms

Affected ranges

Type

GIT

Repo

https://github.com/concretecms/concretecms

Events

Introduced

8fe9708072c3815a5df719b592e4b23b43b4ff7a

Fixed

9379c29cb26a1054208b37507b6869811aa75a32

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "9.5.2"
        },
        {
            "last_affected":  "9.5.2"
        },
        {
            "introduced":  "0"
        },
        {
            "fixed":  "9.5.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

9.*

9.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68526.json"