CVE-2026-68535 Missing authorization in Concrete CMS
An authenticated editor can bypass file-manager permissions to reference and expose unauthorized files via the Area API block-create endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-68535?
CVE-2026-68535 is a medium-severity missing authorization vulnerability in Concretecms Concrete Cms, published on 11 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the referenced file is authorized against the user's file-manager visibility. As a result, an authenticated user holding the block-add scope could store, and cause the page to render, a reference to a file that the file-manager authorization policy would otherwise reject, disclosing that file's URL and preview to the editor and to visitors of the affected page. Under public file storage, the URL and thumbnail are exposed directly; under private storage, the disclosure is limited by the permission-checked download URL. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
Weakness: CWE-862
Which versions are affected by CVE-2026-68535?
It affects 1 product.
Products include Concretecms Concrete Cms.
How do I fix CVE-2026-68535?
No fix has been published for CVE-2026-68535 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-68535 being exploited?
There is no known exploitation of CVE-2026-68535 in the wild and no public exploit code.
Other vulnerabilities in Concretecms Concrete Cms
- CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- CVE-2022-21829 Code injection in concrete CMS
- CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5
- CVE-2021-40098 Path traversal in n/a
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
Sources
Also known as GHSA-pcwm-p48j-jmfv.