CVE-2026-18120 Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data
Unauthenticated attackers can enumerate Express entry data via a legacy search endpoint that bypasses permission checks, exposing restricted attribute values.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18120?
CVE-2026-18120 is a medium-severity missing authorization vulnerability in Concretecms Concrete Cms, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier could enumerate that entity's entry search results, disclosing attribute values intended to be restricted to privileged users. For Express entities that do not support entry-specific permissions (i.e., supportsEntrySpecificPermissions() returns false), per-entry permission filtering is additionally disabled via EntryList::ignorePermissions(). The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Daniel Powell for reporting.
Weakness: CWE-862
Which versions are affected by CVE-2026-18120?
It affects 1 product.
Products include Concretecms Concrete Cms.
How do I fix CVE-2026-18120?
No fix has been published for CVE-2026-18120 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-18120 being exploited?
There is no known exploitation of CVE-2026-18120 in the wild and no public exploit code.
Other vulnerabilities in Concretecms Concrete Cms
- CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- CVE-2022-21829 Code injection in concrete CMS
- CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5
- CVE-2021-40098 Path traversal in n/a
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
Sources
Also known as GHSA-3w9f-9wfp-x8gr.