Threat Intelligence Report — CVE-2026-18423

Executive Summary

CVE-2026-18423 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Concrete CMS versions 9.0.0 through 9.5.2, specifically within the Express saved search preset delete and edit dialogs. An authenticated user who holds only view permission on a single Express entity can permanently delete (with no undo) or rename saved search presets belonging to Express entities they are not authorized to modify. The impact is limited to integrity and availability of preset configuration data (CVSS v4.0 score 2.1), but the rereflection of renamed presets to legitimate users of the targeted entity opens a social-engineering and defacement vector. No public exploit code, PoC, or Nuclei template is currently available, and no vendor patch has been published at the time of writing.

Technical Analysis

Concrete CMS is a widely deployed open-source content management system. Its "Express" subsystem allows developers and administrators to model custom data objects (entities) with associated data and to persist search configurations as saved search presets. These presets are administrative artifacts attached to a specific Express entity and are manipulated through dedicated delete and edit dialogs in the CMS back office.

The vulnerability class is CWE-639: Authorization Bypass Through User-Controlled Key — commonly referred to as IDOR. The root cause described by the CNA is that the delete and edit dialogs for Express saved search presets do not enforce object-level authorization against the ownership of the preset. Instead of validating that the acting user holds appropriate permission on the Express entity that owns the preset, the application appears to authorize the action based solely on the fact that the requester is authenticated and holds view permission on at least one unrelated Express entity.

This is a classic horizontal/vertical permission-boundary failure:

• Authentication — required (the attacker must be an authenticated Concrete CMS user). The CVSS vector reflects this with PR:H (Privileges Required: High) and AT:P (Attack Requirements: Present), indicating the attack depends on the user having some pre-existing, non-trivial access to the CMS.
• Authorization — absent for the targeted object. The preset identifier supplied to the delete/edit dialog is accepted and acted upon without confirming that the caller owns or can manage the preset's parent entity.
• Integrity impact (VI:L) — preset names and configurations can be altered by an unauthorized actor.
• Availability impact (VA:L) — deletion of a preset is described as permanent, with no undo mechanism, meaning configuration data is irrecoverably lost.
• No confidentiality impact (VC:N) — the flaw does not expose data; it only allows modification/deletion of preset metadata.

The AC:L (Attack Complexity: Low) subscore indicates that once the preconditions are met, exploitation requires no special conditions, timing windows, or race states. The UI:N (User Interaction: None) means the attacker does not need to trick a victim into an action for the modification step to succeed; however, the described rereflection of a renamed preset name back to users of the targeted entity constitutes a passive form of interaction for the downstream social-engineering impact.

No CVSS v3.1 vector or numeric base score was supplied in the intelligence data (CVSS Score: N/A); the only authoritative vector is the vendor-assigned CVSS v4.0 string above.

Technical detail limitation: The NVD description does not disclose specific function names, class paths, request parameters, or HTTP endpoints. Any such identifiers would be speculation and are intentionally omitted.

Exploitation Scenarios

Important: No public PoC, exploit code, or Nuclei template exists for this CVE. The following attack chain is inferred strictly from the vulnerability class (CWE-639 IDOR) and the description provided. No specific function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification. The attacker identifies a Concrete CMS instance running an affected version (9.0.0–9.5.2). The attacker must already be an authenticated user of that instance with at least view permission on a single Express entity. In a typical permitting scenario, this corresponds to a low-privileged editor, contributor, or departmental user.

2. Triggering the IDOR. Because the saved search preset delete and edit dialogs reference presets by an identifier (a direct object reference) and do not verify ownership, the attacker supplies — or manipulates — the preset identifier for a preset belonging to a different Express entity, one on which they hold no permissions. The application processes the request against object-level authority checks that are missing.

3. Execution / action at the vulnerability-class level. By invoking the preset delete dialog against a foreign preset, the attacker irreversibly removes that preset. By invoking the edit dialog, the attacker renames (and potentially reconfigures) the foreign preset. Both actions rely solely on the absence of an authorization check on the referenced object.

4. Post-exploitation impact. Deletion is permanent and unrecoverable, degrading the configuration integrity of the targeted entity. Renaming is more insidious: the attacker-chosen preset name is displayed back to legitimate users of the targeted Express entity. This creates a defacement surface and, because users trust the preset listing, a credible social-engineering vector (for example, a misleading preset label that steers administrators toward the wrong search or workflow).

The combined effect is a low-severity but high-stealth integrity/availability attack that is difficult to attribute because it leverages a legitimately authenticated session and leaves only configuration-state changes behind.

Impact Assessment

• Confidentiality: None (VC:N, SC:N).
• Integrity: Low (VI:L, SI:N) — preset names/configurations can be altered; displayed back to other users, enabling defacement/social engineering.
• Availability: Low (VA:L, SA:N) — target presets are permanently deletable with no undo.
• Scope: Unchanged across both vulnerable and subsequent systems.
• Vendor-assigned CVSS v4.0 base score: 2.1.

Blast radius: Any Concrete CMS deployment on 9.0.0–9.5.2 that uses Express entities with saved search presets and grants view access to low-trust users. Impact is confined to CMS configuration metadata rather than content confidentiality, limiting the severity, but the social-engineering angle means the effective business risk may exceed the raw score in high-trust environments (e.g., where preset naming conventions drive administrative behavior). EPSS is 0.00282 (~20.8th percentile), indicating a low but nonzero probability of exploitation activity relative to the broader CVE corpus.

Detection Guidance

Note on rule construction: Because the NVD description provides no HTTP endpoints, parameters, or function names, the rules below detect the vulnerability class (authorization-bypass IDOR against saved search preset dialogs) using behavioral and generic web-application-log signals. Tune field values to your Concrete CMS deployment.

Sigma Rule

title: Concrete CMS Express Saved Search Preset IDOR - Unauthorized Delete/Edit
id: 7c1a2f4e-9b3d-4c5e-8a10-6f2b7d9e1c33
status: experimental
description: Detects an authenticated Concrete CMS user invoking Express saved search
  preset delete or edit dialogs in a manner consistent with unauthorized object reference
  (CVE-2026-18423). Tune to environment-specific preset identifiers and user roles.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18423
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_preset:
    cs-method: 'POST'
    c-uri|contains:
      - '/express'
      - '/dashboard'
    c-uri|contains|all:
      - 'preset'
  selection_action:
    c-uri|contains:
      - 'delete'
      - 'edit'
  condition: selection_preset and selection_action
falsepositives:
  - Legitimate administrators managing their own presets
  - Automated CMS maintenance scripts
level: low

YARA Rule

rule CVE_2026_18423_Concrete_CMS_IDOR_Preset
{
    meta:
        author      = "valtersit.com"
        description = "Detects Concrete CMS source versions in the 9.0.0-9.5.2 range vulnerable to Express saved search preset IDOR (CVE-2026-18423)."
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-18423"
        date        = "2026-01-01"
        cve         = "CVE-2026-18423"

    strings:
        $cms      = "Concrete CMS" ascii wide nocase
        $express  = "Express" ascii wide nocase
        $preset   = "saved search" ascii wide nocase
        $version1 = "9.0." ascii
        $version2 = "9.1." ascii
        $version3 = "9.2." ascii
        $version4 = "9.3." ascii
        $version5 = "9.4." ascii
        $version6 = "9.5." ascii

    condition:
        $cms and $express and $preset and
        any of ($version*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18423 Concrete CMS Express Saved Search Preset IDOR Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"express"; nocase; http.uri; content:"preset"; nocase; http.uri; content:"delete"; nocase; http.uri; content:"edit"; nocase; distance:0; sid:2026184230; rev:1; reference:cve,2026-18423; metadata:affected_product Web_Applications, attack_target Web_Server, deployment Perimeter, signature_severity Minor, created_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where event.category == "authentication" and event.action == "user-login" ]
  [ network where url.path : "*express*" and url.path : "*preset*" and http.request.method == "POST" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri)
| where match(uri_lower, "express") AND match(uri_lower, "preset")
  AND (match(uri_lower, "delete") OR match(uri_lower, "edit"))
  AND method="POST"
| stats count AS attempts, values(uri) AS target_uris, dc(uri) AS distinct_uris
    BY clientip, user, status
| where attempts > 5 OR distinct_uris > 3
| sort - attempts

Wazuh OSSEC Rule

<group name="web,concrete_cms,idor,">
  <rule id="202618" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url>\/express.*preset.*(delete|edit)</url>
    <match>POST</match>
    <description>CVE-2026-18423: Possible Concrete CMS Express saved search preset IDOR (delete/edit) attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,pci_dss_6.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED, and no vendor fix, workaround, or affected-version advisory was present in any tracked source.

1) Immediate mitigations (no patch available):

• Restrict the population of authenticated users with view permission on any Express entity to the minimum necessary. Because the flaw requires only view permission on a single entity plus authentication, reducing low-privilege accounts directly shrinks the attack surface.
• Remove view access from Express entities where legitimate users have no operational need for it.
• Monitor and alert on preset delete/edit activity from accounts that do not own the affected entity (see Detection Guidance). Review access logs for unexpected preset deletions or renames.
• Consider temporarily disabling user accounts that have only view-level Express permissions until a fix is available.
• Establish a configuration backup/versioning process for Express saved search presets, since deletions are described as permanent with no undo.

2) Patch / upgrade steps:

• No patch exists. Track the Concrete CMS security advisories and release notes for versions beyond 9.5.2; apply the first release that documents a fix for CVE-2026-18423.
• Treat 9.0.0–9.5.2 as vulnerable and schedule an upgrade immediately once a fixed release is published.
• Verify vendor confirmation of the fix rather than relying on version-number inference alone.

3) Long-term hardening:

• Enforce object-level authorization (ownership/permission checks) in all administrative dialogs handling user-controllable object identifiers — a defense-in-depth control for the entire CWE-639 class.
• Adopt indirect reference maps or tokenized references in place of raw object identifiers for authorization-sensitive operations.
• Implement least-privilege role design for CMS contributors and maintain audit logging on all configuration-mutating administrative actions.
• Regular dependency/version tracking for CMS deployments and a standing process to triage vendor CVSS v4.0 advisories.

References

1. NVD — CVE-2026-18423: https://nvd.nist.gov/vuln/detail/CVE-2026-18423
2. Concrete CMS Security Advisories (vendor): https://www.concretecms.org/security
3. CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA KEV Catalog (not applicable — CVE-2026-18423 is not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploitation status: No CISA KEV entry, no public PoC, no Nuclei template, and no exploit code observed. EPSS 0.00282 (~20.8th percentile) indicates low exploitation likelihood. No threat actor campaigns are associated with this CVE at the time of writing. Credit for discovery: Yalguun Tumenkhuu (fg0x0).