CVE-2026-68526 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller
Attackers can trick authenticated users into duplicating calendar events via CSRF, modifying data without consent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-68526?
CVE-2026-68526 is a medium-severity vulnerability in Concretecms Concrete Cms, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission, so a crafted cross-site request could cause an authenticated user with add-event permission to create duplicate CalendarEvents and CalendarEventVersions records under their own authority. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
Weakness: CWE-352
Which versions are affected by CVE-2026-68526?
It affects 1 product.
Products include Concretecms Concrete Cms.
How do I fix CVE-2026-68526?
No fix has been published for CVE-2026-68526 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-68526 being exploited?
There is no known exploitation of CVE-2026-68526 in the wild and no public exploit code.
Other vulnerabilities in Concretecms Concrete Cms
- CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- CVE-2022-21829 Code injection in concrete CMS
- CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5
- CVE-2021-40098 Path traversal in n/a
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
Sources
Also known as GHSA-7vqm-7j76-2jjr.