CVE-2026-68535

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.2.0 through 9.5.2

Description The Area API's 'block-create' endpoint fails to invoke the validate() method of the block type controller for submitted data. For blocks that reference files, such as hero image and gallery, this method is responsible for authorizing the referenced file against the user's file-manager visibility. Consequently, an authenticated user with the block-add scope can store and render a reference to a file that should be rejected by the file-manager authorization policy. This leads to the disclosure of the file's URL and preview to the editor and page visitors. In public file storage configurations, the URL and thumbnail are exposed directly, while in private storage, disclosure is limited by the permission-checked download URL.

Recommendations Update Concrete CMS to a version later than 9.5.2. As a temporary mitigation, restrict the block-add scope for users who should not have permission to reference sensitive files via the 'block-create' endpoint.