CVE-2026-18423

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.5.2

Description An Insecure Direct Object Reference (IDOR) exists in the Express saved search preset delete and edit dialogs. An authenticated user with only view permissions on a single Express entity can permanently delete or rename saved search presets belonging to Express entities for which they lack permission. This could lead to defacement or social engineering, as renamed presets are visible to users of the targeted entity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.