CVE-2026-18111Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification
Updated under an hour ago ()
Does this affect you?
It affects Concrete CMS and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered without output escaping. A user with page-editing permissions (such as Add Block combined with Edit Contents on a single page) could store a crafted external link value that broke out of the link markup and injected arbitrary JavaScript. The script executed in the browser session of any user who subsequently viewed, previewed, or edited the affected page, which could lead to session hijacking and escalation of privileges up to full administrative takeover. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.5 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks to KhanMarshai for reporting this issue.
- CVSS
- 8.5 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-306
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- ConcreteCMS
- NVD analysis
- Analyzed
- Record last updated
- Sep 22, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Concrete CMS Concrete CMS concrete_cms:concrete_cms (from the name) | from 9.0.0 through 9.5.2 | CNA record |
concretecms concrete_cms concretecms:concrete_cms | before 8.5.21; from 9.0.0 before 9.5.3 | NVD |
References
- https://documentation.concretecms.org/developers/introduction/version-history/953-release-notesrelease-notes, broken-link
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.