CVE-2026-18423 is an insecure direct object reference in Concrete CMS 9.0.0 through 9.5.2, scored high (CVSS 3.1 7.1) in the record. An authenticated user with view rights on one Express entity can delete or rename saved search presets of entities they cannot access. Upgrade to the release in the 9.5.3 notes.
What's affected
The record says Concrete CMS 9.0.0 through 9.5.2 is affected. The only reference is the Concrete CMS version history page whose address ends in 953-release-notes, which suggests the fix shipped in 9.5.3. When we fetched that page it returned an error, so we could not confirm the fixed version. Check the Concrete CMS release notes before you plan the upgrade.
There is also a scoring difference to know about. The description in the record says the Concrete CMS security team gave the issue a CVSS 4.0 score of 2.1, which is low. The record's CVSS 3.1 score is 7.1, which is high. Both describe the same flaw. Which one matters to you depends on how much your site relies on Express entities and per-entity permissions.
The reporter credited in the record is Yalguun Tumenkhuu.
How to check if you're exposed
Sign in to the Concrete dashboard and check the version under System and Settings, or read it from the application's version constant on disk. Compare against 9.0.0 through 9.5.2.
Then find out whether you use Express entities at all. In the dashboard, the Express section lists the entities and their data. If you have none, the flaw has little to act on. If you have several, review which users have view permission on any one entity, since that is the minimum privilege the issue requires.
What to do now
- Check the Concrete CMS version on every site you run.
- Read the 9.5.3 release notes and upgrade to the fixed version that they name.
- Back up the database before upgrading, since deletion of presets cannot be undone in the product.
- Review Express entity permissions and remove view access that is not needed.
- If you find missing or renamed saved search presets, restore them from backup and check who made the change.
Why it matters
The weakness class is CWE-639, authorization bypass through a user controlled key. The dialogs that edit or delete a preset accepted an identifier from the request and did not check that the signed in user had rights over the entity that owns the preset. Changing the identifier was enough to act on someone else's object.
The record describes two kinds of damage. A deleted preset is permanent, and a renamed preset is shown back to users of the targeted entity, which can be used to mislead them. The risk is moderate for most sites, which matches the low v4 score, but the 3.1 vector rates the availability impact as high because of the unrecoverable deletion. KEV status is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes this?
The record's reference is the Concrete CMS 9.5.3 release notes, but we could not load that page. Confirm the fixed version in the notes.
Why do two scores disagree?
Concrete's team scored it 2.1 under CVSS 4.0, while the record shows 7.1 under CVSS 3.1. The scoring methods weigh the same facts differently.
Sources
Last reviewed: 18 October 2026.
