Threat Intelligence Report — CVE-2026-18426

Executive Summary

CVE-2026-18426 is a missing authorization vulnerability (CWE-862) in the Concrete CMS Express Form block affecting versions 9.0.0 through 9.5.2. The block's control-management actions did not enforce a block-level edit-permission check, relying solely on CSRF token validation, which is bound to the user and action rather than to a specific block, page, or form. An authenticated user with edit rights to one Express Form can therefore add, modify, or delete controls on forms they are not authorized to edit — including injecting a control whose value is later rendered as HTML, enabling stored cross-site scripting (XSS).

Technical Analysis

The vulnerability resides in the Concrete CMS Express Form block's control-management workflow. According to the NVD description, control-management actions — the operations that add, modify, or delete controls within an Express Form — were gated solely by CSRF token validation and lacked a block-level edit-permission check.

The core flaw is an access-control design weakness compounded by a CSRF token scoping weakness:

1. Missing function-level authorization (CWE-862). The control-management action handler did not verify that the requesting user held edit permission on the specific Express Form block being manipulated. Any authenticated user who passed the CSRF check could invoke these actions.

2. CSRF token scope too broad. The token is "bound to the user and action rather than to a specific block, page, or form." This means a valid token obtained legitimately for one Express Form can be replayed against a different Express Form. The CSRF protection is effectively neutralized as an authorization boundary, because the same token authorizes the same action name across distinct resources.

3. Stored XSS escalation path. Because a user can inject a control whose value "is later rendered as HTML," an attacker with edit access to a single form can plant a control on another user's form. When that form is rendered, the injected control value is emitted as HTML rather than being escaped, resulting in stored XSS in the victim's browser context.

The attack surface is the administrative editing interface of Concrete CMS where Express Form blocks are managed. Exploitation requires authentication and some form of edit capability on at least one Express Form, making this a privileged-insider or compromised-low-privilege-account risk rather than an anonymous attack.

The CVSS v4.0 vector provided by the Concrete CMS security team reflects this constrained profile:

• AV:N (network reachable)
• AC:H (high complexity — requires token acquisition and suitable permissions)
• AT:P (attack requires a present, active attacker/target interaction condition)
• PR:H (high privileges required)
• UI:P (passive user interaction)

The base metrics show VC:L (low confidentiality), with VI:N / VA:N and all subsequent-system metrics N — i.e., the direct impact is limited, and the more serious stored XSS consequence is not captured by the base score because it requires chaining and victim rendering.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (missing authorization + token scope confusion) and the NVD description.

1) Reconnaissance / Target Identification The attacker identifies a Concrete CMS instance running version 9.0.0 through 9.5.2 that uses Express Form blocks. This is a targeted, authenticated scenario: the attacker must already possess a valid account with edit access to at least one Express Form. Access can be obtained through legitimate low-privilege provisioning, credential compromise, or an insider threat.

2) Triggering the Specific Flaw Class The attacker locates an Express Form they are authorized to edit and performs a control-management action (add, modify, or delete a control). By observing the request, the attacker captures a validly issued CSRF token for the action. Because the token is scoped only to the user and the action name — not to a specific block, page, or form — it can be reused against a different Express Form.

3) Payload / Execution Method (vulnerability-class level) The attacker replays the captured token while targeting an Express Form they are not authorized to edit. The server processes the control-management action because it validates only the token and never checks block-level edit permission. The attacker adds, modifies, or deletes controls on the unauthorized form. To escalate, the attacker injects a control whose value is later rendered as HTML.

4) Post-Exploitation Impact The injected HTML is rendered in the context of the affected form, producing stored XSS for any user who views that form. This can lead to session hijacking, credential theft, or further actions in the victim's browser context. Directly, the attacker can also tamper with or destroy form definitions belonging to other users, degrading data integrity of the targeted forms. Note that base CVSS metrics rate VI/VA as None — the primary scored impact is limited confidentiality loss, with the XSS being a chained consequence rather than a base-scored outcome.

Impact Assessment

• Confidentiality (VC:L): Low direct impact; the stored XSS chained outcome may elevate real-world risk beyond the base metric.
• Integrity (VI:N) / Availability (VA:N): No base-scored integrity or availability impact.
• Subsequent system impact (SC/SI/SA: N): None scored.
• Privileges Required (PR:H): The attacker must already hold an authenticated account with edit access to at least one Express Form.
• Attack Complexity (AC:H): High — requires capturing a valid token and identifying an out-of-scope target form.
• User Interaction (UI:P): Passive interaction — a victim must render the affected form to trigger the stored XSS.

Blast radius: Limited to Concrete CMS deployments using Express Form blocks on affected versions (9.0.0–9.5.2). The practical attack surface is the set of authenticated editing users. The primary business risks are unauthorized modification/deletion of form definitions and stored XSS against form viewers. EPSS is 0.00228 (13.7th percentile), indicating low predicted exploitation likelihood in the near term, and the CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Concrete CMS Express Form Unauthorized Control-Management Action
id: 6f2b9c14-1c7e-4a3b-9f2a-concrete18426
status: experimental
description: Detects HTTP requests to Concrete CMS Express Form control-management
  actions that may indicate CSRF-token reuse against unauthorized forms.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18426
author: Valters IT Threat Intel
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - GET
  selection_path:
    cs-uri-stem|contains:
      - '/dashboard/express'
      - '/express/'
      - '/ccm/express'
  selection_action:
    cs-uri-query|contains:
      - 'action=add_control'
      - 'action=edit_control'
      - 'action=delete_control'
  condition: selection_method and selection_path and selection_action
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate administrators managing their own Express Forms
level: medium
tags:
  - attack.t1190
  - cve.2026.18426

YARA Rule

rule CVE_2026_18426_ConcreteCMS_ExpressForm_XSS
{
    meta:
        description = "Detects potential stored XSS payloads injected via Concrete CMS Express Form controls (CVE-2026-18426)"
        author = "Valters IT Threat Intel"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18426"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $express = "express_form" nocase
        $ctrl    = "express/form/control" nocase
        $s1 = "<script" nocase
        $s2 = "javascript:" nocase
        $s3 = "onerror=" nocase
        $s4 = "onload=" nocase
        $s5 = "<svg" nocase
        $s6 = "document.cookie" nocase

    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x7B0A or true) and
        ($express or $ctrl) and 2 of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18426 Concrete CMS Express Form Unauthorized Control-Management Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"express"; http.uri; content:"control"; http.uri; pcre:"/(add|edit|delete)[_-]?control/i"; http.header; content:"ccm_token"; nocase; classtype:attempted-admin; sid:202618426; rev:1; reference:cve,2026-18426; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method == "POST" and
      http.request.uri : ("*express*control*" or "*express/form*") and
      http.response.status_code == 200]
  [http where http.request.method == "POST" and
      http.request.uri : ("*express*control*add*" or "*express*control*edit*" or "*express*control*delete*") and
      http.response.status_code == 200 and
      not http.request.uri : "*/dashboard/*"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where (like(uri,"%express%control%") OR like(uri,"%express/form%"))
    AND (like(uri,"%add%") OR like(uri,"%edit%") OR like(uri,"%delete%"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as uris by src_ip, user, status
| where status=200 AND count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,concretecms,cve-2026-18426,">
  <rule id="100426" level="8">
    <if_sid>31100</if_sid>
    <field name="url" type="pcre2">(?i)express.*(add|edit|delete).*control</field>
    <description>CVE-2026-18426: Possible Concrete CMS Express Form unauthorized control-management request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_18426,</group>
  </rule>

  <rule id="100427" level="10">
    <if_sid>31100</if_sid>
    <field name="url" type="pcre2">(?i)express.*control</field>
    <field name="url" type="pcre2">(?i)(&lt;script|javascript:|onerror=|onload=)</field>
    <description>CVE-2026-18426: Suspected stored XSS payload in Concrete CMS Express Form control</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_18426,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no workaround, and no affected-version metadata have been recorded. The CVE covers Concrete CMS 9.0.0 through 9.5.2, and the OSV package entry remains unfixed.

1. Immediate mitigations

   • Restrict who holds Express Form edit permissions; apply least privilege to admin accounts.
   • Reduce the number of users with any Express Form edit capability, since possession of a single valid token is the pivot for this attack.
   • Monitor for anomalous control-management requests against forms a given user does not own.
   • Consider temporarily disabling Express Form control editing if it is not operationally required.
   • Monitor the upstream Concrete CMS security advisory channel for an official fix covering the 9.0.0–9.5.2 range.

2. Patch / upgrade steps

   • No patch is confirmed. Do not assume any version is fixed until the vendor publishes an advisory. Track the Concrete CMS security release notes and apply the first release that explicitly references CVE-2026-18426.
   • Where feasible, migrate away from the vulnerable range to a maintained, vendor-confirmed release once available.

3. Long-term hardening

   • Enforce server-side, per-object authorization checks (block-level edit permission) in addition to CSRF validation — CSRF tokens must never serve as the sole authorization control.
   • Bind CSRF tokens to specific resource identifiers (block, page, form) rather than user + action only.
   • Apply output encoding/escaping to all control values to prevent stored XSS, and deploy a Content Security Policy.
   • Log and alert on all control-management operations with actor, target form, and result.

References

• NVD — CVE-2026-18426: https://nvd.nist.gov/vuln/detail/CVE-2026-18426
• Concrete CMS security advisories (vendor): https://www.concretecms.org/security
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• FIRST EPSS (CVE-2026-18426): https://api.first.org/data/v1/epss?cve=CVE-2026-18426
• CISA Known Exploited Vulnerabilities catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. No public PoC, no Nuclei template, no observed exploitation, and no CISA KEV listing at time of writing. Reported by Yat Wu. EPSS 0.00228 (13.7th percentile) indicates low predicted exploitation activity.