---
id: CVE-2026-81916
title: >-
  Concrete CMS before 9.5.3 evaluated the authorization check for an Express
  entry submission against the entity of the posted form rather than the entity
  identified by the dashboard route
summary: >-
  Concrete CMS before 9.5.3 evaluated the authorization check for an Express
  entry submission against the entity of the posted form rather than the entity
  identified by the dashboard route. As a result, a user permitted to add
  entries to o…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-639
  - CWE-862
vendor: concretecms
product: concrete_cms
affected:
  - concrete_cms < 9.5.3
patched:
  - concrete_cms 9.5.3
published: '2026-09-11'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T15:23:18.233'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81916'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
epss: 0.00272
epssPercentile: 0.17604
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T12:50:40.342576Z'
scores:
  nvd: 4.3
  cna: 5.1
ingestedAt: '2026-09-14T15:23:07.428Z'
---

## Overview

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Express object outside their authorization scope, potentially polluting protected datasets, triggering workflows, or injecting content into administrative processes. The dashboard submit route resolved the mutated entity from the attacker-controlled route ID while the permission check validated the independently posted form's entity, and the submission proceeded because the two entities were never compared. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

## Affected

- `concrete_cms < 9.5.3`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.3`