CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-81916 Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...

CVE-2026-81916 Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...

EUVD-2026-76687

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...

CVE-2026-81916

Concrete CMS before 9.5.3 contains an authorization bypass in the Express entry submission flow. The dashboard submit route resolved the target entity from an attacker-controlled route ID, while the permission check validated the independently posted form's entity — the two were never compared. A...

CVE-2026-81915

Concrete CMS below 9.5.3 has a missing object-level authorization check in the Types::submit() dashboard controller. When updating a Page Type, the controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), allowing a signed-in dashboard user a...

CVE-2026-81915 In Concrete CMS below 9.5.3, Page Type update omits object-level authorization

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...

CVE-2026-81915 In Concrete CMS below 9.5.3, Page Type update omits object-level authorization

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...

EUVD-2026-76249

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...

jsherp-user-info-idor

jshERP /user/info IDOR — VulDB submission package This repository contains a standalone VulDB-style advisory for an authenticated insecure direct object reference in jshERP. Product: jshERP Tested commit: ad6cf886dd4e0676723060a25d361c703dc56bc0 3.6-SNAPSHOT, GitHub master HEAD on 2026-09-04...

EUVD-2026-76244

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49463 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49463

NL Portal Backend Libraries (Dutch government portal backend) contained a missing per-user authorization in two GraphQL resolver areas. The nl.nl-portal:documenten-api package (all versions up to 3.0.0) and nl.nl-portal:besluiten package (1.5.0–3.0.0) both declared resolvers without an authentica...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-81912

Concrete CMS before 9.5.3 contains a Cross-Site Request Forgery (CSRF) flaw in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved selected group tree nodes without validating an action token, allowing a state-changing group move to be processed agains...

EUVD-2026-76243

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-62089

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

WordPress DT LMS – elearning, WordPress LMS Plugin plugin <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability discovered by adhikara13 in WordPress Plugin DT LMS – elearning, WordPress LMS Plugin versions = 1.1...

CVE-2026-81909

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...