CVE-2026-18421

Concrete CMS versions 9 through 9.5.2 contain a missing authorization check in the Boards data source dashboard controller . The three affected actions (update , update_data_source , and delete_data_source ) resolve a ConfiguredDataSource directly from an attacker-supplied identifier without conf...