Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on o

{
  "id": "73733d9d7ba412e958dff7ea2970e7228db874e88e846efbe497a38f32c81041",
  "url": "https://osv.dev/vulnerability/CVE-2026-18423",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on o",
    "summary": "Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved search presets owned by Express entities for which they had no permission, and a renamed preset name was displayed back to users of the targeted entity, enabling defacement or social engineering. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Yalguun Tumenkhuu ( fg0x0 ) for reporting.",
    "evidence": "osv:CVE-2026-18423",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2026-18423",
      "aliases": [
        "CVE-2026-18423"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/concretecms/concretecms",
              "type": "GIT",
              "events": [
                {
                  "introduced": "b3774abddd475b4ba98b637402506f7a5ebd90ea"
                },
                {
                  "fixed": "9379c29cb26a1054208b37507b6869811aa75a32"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "9.0.0"
                      },
                      {
                        "last_affected": "9.5.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "cpe": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "9.0.0"
                      },
                      {
                        "fixed": "9.5.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18423.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:27.867091407Z",
      "provider": "osv",
      "references": [
        "https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18423.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-18423",
        "https://github.com/concretecms/concretecms"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-639"
        ],
        "cna_assigner": "ConcreteCMS",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18423.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-18423",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 494499,
  "published_at": "2026-09-15T19:30:13.788+00:00"
}