CyberRota Analysis
AI-GeneratedConcrete CMS versions 9.0.0 through 9.5.2 have a vulnerability in the advanced-search dashboard action, allowing authenticated users with limited permissions to access entries from any Express entity by manipulating entity IDs. This flaw can lead to unauthorized disclosure of sensitive information, including secret attribute values and form submissions, breaching the intended permission boundaries. Organizations using affected versions should prioritize remediation to protect against potential data leaks.
Original NVD Description
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries without invoking canViewExpressEntries(), the per-entity permission check that the sibling results() action enforced. An authenticated dashboard user holding view_express_entries on a single Express entity could read the entries of any other entity, including secret attribute values, by requesting the advanced-search action with that entity's ID, disclosing form submissions and CRM-style records across the per-entity permission boundary that Express is designed to enforce. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.