CVE-2026-68535

Received Received - Intake

Information Disclosure in Concrete CMS via Block-Create Endpoint

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the referenced file is authorized against the user's file-manager visibility. As a result, an authenticated user holding the block-add scope could store, and cause the page to render, a reference to a file that the file-manager authorization policy would otherwise reject, disclosing that file's URL and preview to the editor and to visitors of the affected page. Under public file storage, the URL and thumbnail are exposed directly; under private storage, the disclosure is limited by the permission-checked download URL. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-68535

Affected Vendors & Products

Vendor	Product	Version / Range
concrete_cms	area_api	From 9.2.0 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Concrete CMS versions 9.2.0 to 9.5.2 had a flaw in the Area API's block-create endpoint. It failed to call the block type controller's validate() method for submitted data. This allowed authenticated users with the block-add scope to store and render references to files they shouldn't access, exposing file URLs and previews.

Detection Guidance

Check Concrete CMS logs for unauthorized block creation events, particularly for file-referencing blocks like hero_image or gallery. Inspect block type controller validate() method invocations to ensure proper authorization checks are performed.

Impact Analysis

An attacker with limited access could exploit this to view files they are not authorized to see. If files are stored publicly, the attacker can directly access the file URL and thumbnail. For private storage, the exposure is limited to permission-checked download URLs.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, potentially violating data protection regulations like GDPR or HIPAA. Unauthorized file access may result in data breaches, leading to legal penalties and reputational damage.

Mitigation Strategies

Update Concrete CMS to a version that includes the fix for this vulnerability. Review and restrict the block-add scope permissions to only trusted users. Audit existing blocks for unauthorized file references.

Hi! I’m here to help you understand CVE-2026-68535. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70