CVE-2026-18422 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

CVE-2026-18422 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

CVE-2026-81919

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of Concrete\Controller\Backend\Page\ArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an...

CVE-2026-81924

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...

CVE-2026-81920

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2026-78081

Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A forged request riding a victim's active checkout session could silently overwrite the billing or shipping address before order confirmation...

CVE-2026-68532

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete...

CVE-2026-68530

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-18421

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

EUVD-2026-79187

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421

Concrete CMS versions 9 through 9.5.2 contain a missing authorization check in the Boards data source dashboard controller . The three affected actions (update , update_data_source , and delete_data_source ) resolve a ConfiguredDataSource directly from an attacker-supplied identifier without conf...

CVE-2026-18421 Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-68530 Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

EUVD-2026-79180

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-68530 Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-68530 Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-68530

Concrete CMS versions 9.0.0 through 9.5.2 contain an authorization bypass in the Boards area of the Dashboard. The instance-details single-page controller resolved a board instance directly from an attacker-supplied ID and performed view, refresh, regenerate, or delete actions without verifying t...

CVE-2026-81924 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...

CVE-2026-81924 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...