EUVD-2026-80881

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

PT-2026-93853

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9 through 9.5.3 Description An authenticated user with edit-board-contents permission on a single board instance can access summary fields, such as the page title and description, of pages they are not authorized to view...