CVE-2026-18423

Concrete CMS versions 9.0.0 through 9.5.2 contain an Insecure Direct Object Reference (IDOR) flaw in the Express saved search preset delete and edit dialogs. An authenticated user holding only view permission on a single Express entity could permanently delete (no undo) or rename saved search pre...