CVE-2026-18423: Concretecms Concrete CMS

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved search presets owned by Express entities for which they had no permission, and a renamed preset name was displayed back to users of the targeted entity, enabling defacement or social engineering. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Yalguun Tumenkhuu ( fg0x0 ) for reporting.

Affected products

• Concretecms Concrete CMS: from 9.0.0, before 9.5.3 (fixed in 9.5.3)

Published 2026-09-15. Last modified 2026-09-21.