CVE-2026-18120

Executive Summary

CVE-2026-18120 is a missing-authorization vulnerability (CWE-862) in Concrete CMS before 9.5.3, where a legacy Express entry search endpoint returned entry result JSON without invoking the canViewExpressEntries() permission check used by the normal dashboard and CSV Export flows. An unauthenticated visitor who knows or can discover an Express entity identifier may enumerate that entity's entry search results, disclosing attribute values intended to be restricted to privileged users. The vendor assigned a CVSS v4.0 score of 6.3 (Medium), reflecting network reachability but high attack complexity and Confidentiality-only impact.

Technical Analysis

The flaw is an access-control defect rooted in a code-path asymmetry. Concrete CMS provides two distinct mechanisms for exposing Express entity data:

1. Authorized flows — the standard dashboard interface and the CSV Export flow. Per the NVD description, both of these invoke canViewExpressEntries() before returning results.
2. A legacy Express entry search endpoint — this endpoint returns entry result JSON but does not invoke canViewExpressEntries().

Because the legacy endpoint omits the permission gate, an unauthenticated requester who supplies (or guesses/derives) a valid Express entity identifier receives the same entry-search JSON that an authorized user would receive through the dashboard. This is a classic instance of CWE-862: the endpoint exists, functions correctly for data retrieval, but lacks the authorization check that every equivalent sibling flow performs.

The description further notes a second-order weakening: for Express entities that do not support entry-specific permissions — i.e., where supportsEntrySpecificPermissions() returns false — per-entry permission filtering is additionally disabled through a call to EntryList::ignorePermissions(). This means that for such entities, there is not merely a missing top-level gate but a positively disabled per-row filter, so even if entry-level checks were reachable they would be bypassed for these entities.

Attack surface: the HTTP-accessible legacy search endpoint. Network position is sufficient — no authentication, no session, no user interaction is required. The attack complexity is rated High (AC:H) in the CVSS vector, which is best explained by the prerequisite that the attacker must know or discover a valid Express entity identifier; the exploit itself, once that identifier is known, is a straightforward unauthenticated request.

Data at risk: entry attribute values for the targeted Express entity — the same content the CSV Export flow would produce for a privileged user. The vulnerability does not permit modification, deletion, or code execution; the CVSS vector confirms VC:L (Confidentiality: Low) with VI:N (Integrity: None) and VA:N (Availability: None). Subsequent-system impacts (SC:N, SI:N, SA:N) are all None, meaning no cross-boundary compromise is expected.

Insufficient technical detail available in the supplied data regarding: the exact URL path of the legacy endpoint, the HTTP method, the query parameters used to specify the entity identifier, and whether the ignorePermissions() behavior is scoped to a specific list class. No function names, endpoints, or parameters should be assumed beyond canViewExpressEntries(), supportsEntrySpecificPermissions(), EntryList::ignorePermissions(), and the concepts "Express entry search endpoint," "dashboard," and "CSV Export," which appear verbatim in the NVD description.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-18120 (PoC_STATUS: None). The attack chain below is derived strictly from the vulnerability class (missing authorization) and the specifics stated in the NVD description.

Step 1 — Reconnaissance / target identification. The attacker identifies Concrete CMS instances, for example via the public fingerprint of the product (e.g., directory naming under /concrete/, response headers, or version-disclosing paths). The attacker then needs at least one valid Express entity identifier. These identifiers may be obtainable from: indexed search-engine results, exposed content that references Express-backed data blocks, front-end page rendering that surfaces entity IDs, or simple enumeration if identifiers are sequential/integer-based. Because the vulnerable endpoint is reachable without authentication, no credential-gathering or session establishment is needed.

Step 2 — Triggering the flaw. The attacker sends a request directly to the legacy Express entry search endpoint (whose exact path is not disclosed in the supplied data), supplying the discovered entity identifier. Critically, the attacker does not need to authenticate and does not need to pass any visitor permission checks — the endpoint's handler returns entry result JSON without invoking canViewExpressEntries().

Step 3 — Payload / execution method. At the vulnerability-class level, the "payload" is simply a well-formed search request to the legacy endpoint carrying the target entity identifier. For Express entities where supportsEntrySpecificPermissions() returns false, the response additionally reflects the effects of EntryList::ignorePermissions() — per-entry permission filtering is disabled, so all matching entries are returned rather than the subset the requester would otherwise be entitled to see.

Step 4 — Post-exploitation impact. The attacker receives JSON describing the entity's entry search results, including attribute values intended for privileged users. Because Confidentiality impact is Low (VC:L) and Integrity/Availability impacts are None, the practical post-exploitation outcome is data disclosure, not tampering or service disruption. The attacker may iterate over multiple known/discovered entity identifiers to expand the data set harvested. Disclosed attributes could include internal names, configuration-like values, or business data that administrators expected to remain behind dashboard restrictions — enabling further targeted social engineering or reconnaissance.

There is no evidence of weaponization, exploit-in-the-wild activity, or inclusion in CISA KEV.

Impact Assessment

• Confidentiality: Low (VC:L). Unauthorized read of Express entry search results and attribute values for targeted entities.
• Integrity: None (VI:N). No modification capability.
• Availability: None (VA:N). No denial-of-service vector.
• Subsequent systems: None (SC:N / SI:N / SA:N). No lateral movement or cross-trust-boundary effects described.
• Attack vector / complexity: Network (AV:N) with High complexity (AC:H), because a valid Express entity identifier must be known or discovered. Attack requirements are Present (AT:P), privileges required None (PR:N), user interaction None (UI:N) — meaning no account or victim cooperation is needed.
• CWE mapping: CWE-862 (Missing Authorization).

Business impact: Organizations running Concrete CMS for intranet portals, customer-facing sites with Express-backed structured data, or any deployment where Express entities hold sensitive attribute values (e.g., member data, product/inventory metadata, internal workflow records) face potential unintended disclosure. The blast radius is bounded by (a) the number of Express entities on the installation and (b) how discoverable those entity identifiers are. Because identifiers rather than credentials gate exploitation, exposure scales with how aggressively the target's identifiers leak through normal site content.

Detection Guidance

Sigma Rule

title: Concrete CMS Unauthenticated Legacy Express Entry Search Access (CVE-2026-18120)
id: 4f1c9c2a-8b7e-4d2a-9c3e-2b6a7d0f5e11
status: experimental
description: Detects unauthenticated access to the legacy Concrete CMS Express entry search
  endpoint that bypasses canViewExpressEntries() (CVE-2026-18120).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18120
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: 'express'
  selection_search:
    cs-uri-query|contains:
      - 'search'
      - 'entries'
  filter_authenticated:
    cs-username|exists: true
  condition: selection_path and selection_search and not filter_authenticated
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs(User-Agent)
falsepositives:
  - Legitimate dashboard and CSV export requests (authenticated sessions)
  - Search engine crawlers hitting Express-backed public pages
level: medium
tags:
  - attack.t1190
  - cve.2026.18120

YARA Rule

rule CVE_2026_18120_ConcreteCMS_Express_Authz_Bypass
{
    meta:
        description = "Detects Concrete CMS source files referencing the Express entry search flow and permission helpers relevant to CVE-2026-18120"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18120"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $fn1 = "canViewExpressEntries" ascii wide
        $fn2 = "supportsEntrySpecificPermissions" ascii wide
        $fn3 = "ignorePermissions" ascii wide
        $ctx1 = "Express" ascii wide
        $ver = "9.5.3" ascii wide

    condition:
        uint32(0) != 0xCAFEBABE and
        filesize < 5MB and
        (
            ($fn1 and $fn2) or
            ($fn1 and $fn3) or
            ($fn2 and $fn3)
        ) and $ctx1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18120 Concrete CMS Legacy Express Entry Search Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"express"; nocase; http.uri; content:"search"; nocase; http.header; content:"Cookie"; negate; threshold:type limit, track by_src, count 5, seconds 60; reference:cve,2026-18120; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-18120; classtype:attempted-recon; sid:2026181200; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where http.request.method == "GET"
      and url.path : "*express*"
      and url.query : "*search*"
      and not user.name : * ]
  [ network where http.response.status_code == 200
      and http.response.mime_type : "application/json" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval uri=coalesce(uri, request, cs_uri_stem)
| eval query=coalesce(query, cs_uri_query, url_query)
| where match(uri, "(?i)express") AND match(query, "(?i)(search|entries)")
| where isnull(remote_user) OR remote_user="" OR remote_user="-"
| stats count values(uri) as uris values(status) as statuses dc(clientip) as unique_ips by clientip, useragent
| where count >= 3 AND (statuses="200" OR statuses="200 ")
| sort - count

Wazuh OSSEC Rule

<group name="web,concrete_cms,cve-2026-18120,">
  <rule id="2026181" level="10">
    <if_sid>31100</if_sid>
    <id>^GET</id>
    <url>express</url>
    <url>search</url>
    <description>CVE-2026-18120: Possible unauthenticated access to Concrete CMS legacy Express entry search endpoint (authorization bypass).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_18120,access_control_bypass,</group>
  </rule>
  <rule id="2026182" level="12">
    <if_sid>2026181</if_sid>
    <url>express</url>
    <url>entries</url>
    <same_source_ip />
    <frequency>5</frequency>
    <timeframe>60</timeframe>
    <description>CVE-2026-18120: Repeated unauthenticated Express entry enumeration from same source IP (possible data harvesting).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory URL, commit, or fixed-version artifact was supplied. The NVD description states the issue is fixed in Concrete CMS 9.5.3.

1) Immediate mitigations (until upgrade is validated):

• Block external access to the legacy Express entry search endpoint at the reverse proxy / WAF layer. Because the exact path is not enumerated in the supplied data, the defender must first inventory the application's routes (e.g., inspect the Concrete CMS route configuration for Express-related controllers) and then deny unauthenticated requests to the legacy search route while permitting legitimate dashboard/CSV-export traffic.
• Require authentication in front of the affected route: enforce a session/cookie requirement at the edge (e.g., reject requests lacking a valid Concrete CMS session cookie to paths matching the legacy endpoint).
• Restrict network exposure of administrative and data-bearing endpoints to trusted networks/IP allowlists.
• Monitor for and, where feasible, rotate any Express entity attribute values that may have been exposed.

2) Patch / upgrade steps:

• Upgrade Concrete CMS to 9.5.3 or later, which per the NVD description addresses the missing authorization check.
• Validate the upgrade in staging: confirm that the normal dashboard and CSV Export flows still call canViewExpressEntries(), and confirm the legacy endpoint no longer returns entry JSON to unauthenticated callers.
• Where possible, verify the fix by unauthenticated request to the legacy endpoint and confirming a denial (401/403/redirect) rather than JSON.
• Obtain the authoritative vendor advisory from concretecms.org prior to change-window approval; the supplied dataset contains no advisory URL and patch confidence is 0/4.

3) Long-term hardening:

• Add automated regression tests that assert every JSON-returning Express search/list route enforces canViewExpressEntries() prior to serialization.
• Review EntryList usage across the codebase for any other call sites invoking ignorePermissions(), and ensure such calls are unreachable from unauthenticated request paths.
• Apply a deny-by-default authorization framework for all REST/JSON endpoints, rather than relying on each controller to remember the permission gate.
• Continuously inventory legacy/deprecated endpoints and decommission or gate them with explicit authentication.
• Monitor vendor channels for a formal security advisory for CVE-2026-18120, which may assign additional identifiers or workaround guidance.

References

1. NVD — CVE-2026-18120: https://nvd.nist.gov/vuln/detail/CVE-2026-18120
2. CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Concrete CMS official site / security announcements (vendor advisory to be located): https://www.concretecms.org/
5. FIRST.org EPSS — not yet scored for this CVE; consult https://www.first.org/epss/ for updated scoring.

Exploit-in-the-wild / threat actor evidence: None. CISA KEV: NO. No public PoC, Nuclei template, or exploit code was identified in the supplied dataset (PoC_STATUS: None). No known threat actor campaigns are associated with this CVE as of the time of writing.