Threat Intelligence Report — CVE-2026-87028

Executive Summary

CVE-2026-87028 is a missing-authorization vulnerability (CWE-862) in Concrete CMS versions 9 through 9.5.3. Two distinct authorization checks were omitted: (1) the custom-slot preview endpoint failed to confirm that a submitted InstanceItem identifier belonged to the board instance the requesting user was authorized to edit, and (2) page-view permission was not enforced before generating page-backed summary content. An authenticated attacker holding edit-board-contents permission on even a single board instance can therefore submit an item identifier belonging to a different board instance and receive summary fields — including the page title and description — of a page they are otherwise forbidden to view. The vendor-assigned CVSS v4.0 score is 5.3 (Medium), reflecting a fully remote, low-complexity, authenticated attack with low confidentiality impact and no integrity or availability impact; no public PoC or exploit code exists, and the vulnerability is unpatched in all tracked sources.

Technical Analysis

Concrete CMS is a PHP-based, open-source content management system. The affected versions (9.0.0 through 9.5.3) include the "boards" feature, which allows site administrators and delegated editors to curate collections of items (InstanceItem) — typically pages or page-backed content — into configurable board instances. Board contents are permission-scoped: a user granted edit-board-contents permission on one board instance is NOT authorized to edit or read the contents of another.

The vulnerability consists of two independent authorization failures that chain together:

1. Cross-instance object reference (missing ownership validation). The custom-slot preview endpoint accepts a submitted InstanceItem identifier. Per the NVD description, the CMS "did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit." This is a classic IDOR-adjacent, broken-object-level-authorization condition: the endpoint validates that the caller is an authorized board editor, but not that the caller is authorized for that specific board instance. An attacker with edit-board-contents on any one board instance can submit the identifier of an item belonging to a different board instance.

2. Missing page-view permission enforcement. After resolving the item, the endpoint generates "page-backed summary content." Per the description, the CMS "did not enforce page-view permission before generating page-backed summary content." The summary fields returned include the page title and description of the underlying page — meaning that even if the referenced page is access-restricted (unpublished, private, or restricted to specific groups), its metadata is still disclosed via the preview response.

The net effect: an authenticated low-privilege board editor can enumerate InstanceItem identifiers and read the title and description of arbitrary pages whose view permission they do not hold.

Attack surface. The custom-slot preview endpoint is network-reachable (CVSS AV:N) and requires only a low-privileged, authenticated session (PR:L). No user interaction is required (UI:N). The attack complexity is low (AC:L) — the primary requirement is the ability to guess or enumerate valid InstanceItem identifiers, which are typically sequential or otherwise discoverable.

Code-level notes. NVD does not disclose the specific controller, route, or parameter names involved, nor the fix commit. Consistent with CWE-862, the defect is an absent authorization gate rather than a faulty comparison or injection flaw; the mechanism is a missing check on (a) ownership of the referenced item by the authorized board instance, and (b) the caller's page-view capability. No further implementation detail can be stated without inventing specifics not present in the source data.

Scoring rationale. CVSS v4.0 5.3 with VC:L (low confidentiality impact on the vulnerable system) and all other sub-scores None (VI:N, VA:N, SC:N, SI:N, SA:N). The Low rather than High confidentiality impact reflects that only page title and description metadata are disclosed — not full page content, bodies, or credentials.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-862 missing authorization) and the exact mechanics stated in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Concrete CMS 9.x–9.5.3 target (via Shodan or by browsing the site). They must obtain a valid authenticated account — this could be a legitimate low-privilege editor account, a self-registered account if registration is open, or a compromised account. The attacker confirms the account holds edit-board-contents permission on at least one board instance.

2. Triggering the specific flaw class. The attacker accesses the custom-slot preview endpoint and submits an InstanceItem identifier. Because the endpoint does not verify that the submitted item belongs to the board instance the attacker is authorized to edit, any valid identifier for an item on a different board instance is accepted. The identifier may be obtained via enumeration (sequential IDs) or by observing identifiers returned by legitimate preview requests on boards the attacker can access.

3. Payload / execution method (vulnerability-class level). The request requires no crafted payload in the injection sense — the attack is purely an authorization bypass achieved by substituting a foreign object identifier. The endpoint then proceeds to generate page-backed summary content without enforcing page-view permission, and returns summary fields that include the title and description of the underlying page.

4. Post-exploitation impact. The attacker gains read access to the title and description of pages they are not permitted to view — for example, unpublished drafts, internal announcements, or pages restricted to privileged groups. This is an information-disclosure condition (low confidentiality impact); there is no evidence in the source data of integrity or availability impact, and no privilege escalation or remote code execution is implied. Chained with the enumerated identifiers, an attacker may map the existence and metadata of protected content across the site.

Prerequisite: edit-board-contents permission on at least one board instance. Without such an account, the endpoint's base authorization gate (which does verify the caller is an authorized board editor, just not for the specific board) blocks the request.

Impact Assessment

• Confidentiality: Low. Disclosure is limited to page title and description of otherwise-forbidden pages. No page body, file contents, or credentials are implicated by the description.
• Integrity / Availability: None (VI:N, VA:N). The action is read-only; no modification or denial of service is introduced.
• Blast radius: Any Concrete CMS 9.0.0–9.5.3 site that uses boards and grants edit-board-contents to non-administrative users (e.g., contributors, editors, delegated curators). Administrators and users without board-edit permissions are unaffected.
• Business impact: Sensitive-but-metadata-level leakage — page titles and descriptions can reveal project codenames, unreleased product names, internal policy topics, or the mere existence of restricted pages. This is meaningful for confidentiality-sensitive organizations (legal, HR, M&A, government) but does not directly enable account takeover or code execution.
• Risk context: With no CISA KEV listing, no EPSS score, and no public exploit code, current exploitation likelihood is low (opportunistic discovery only), while the impact per exploitation is bounded by the CVSS 5.3 rating.

Detection Guidance

Sigma Rule

title: Concrete CMS Board InstanceItem Cross-Instance Preview Authorization Bypass (CVE-2026-87028)
id: 7f3c1a92-2b6e-4c8d-9e11-5a0d3b7f4c22
status: experimental
description: Detects authenticated access to the Concrete CMS custom-slot preview endpoint with anomalous or cross-instance InstanceItem identifiers, consistent with CWE-862 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87028
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - "custom-slot"
      - "preview"
  selection_item:
    cs-uri-query|contains: "InstanceItem"
  condition: selection_endpoint and selection_item
fields:
  - c-ip
  - cs-username
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate board editors previewing items on boards they own
level: medium
tags:
  - attack.t1190
  - cve.2026.87028
  - cwe.862

YARA Rule

rule CVE_2026_87028_ConcreteCMS_BoardPreview_AuthzBypass
{
    meta:
        description = "Detects Concrete CMS requests referencing board InstanceItem preview parameters indicative of CVE-2026-87028 cross-instance authorization bypass"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87028"
        date = "2026-01-01"
        cve = "CVE-2026-87028"

    strings:
        $ep1 = "custom-slot" ascii nocase wide
        $ep2 = "preview" ascii nocase wide
        $obj = "InstanceItem" ascii nocase wide

    condition:
        filesize < 5MB and $obj and ($ep1 or $ep2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87028 Concrete CMS custom-slot preview InstanceItem authorization bypass attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"preview"; nocase; http.uri; content:"InstanceItem"; nocase; reference:cve,2026-87028; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87028; classtype:attempted-recon; sid:202687028; rev:1;)

Elastic Detection

sequence by user.name with maxspan=1m
  [ network where http.request.method == "GET" and
      http.request.uri : ("*preview*") and
      http.request.uri : ("*InstanceItem*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*preview*" uri_query="*InstanceItem*"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_query) as query_used
        values(status) as http_status
        by src_ip user
| where count >= 5
| sort - count

Wazuh OSSEC Rule

<group name="web,concrete_cms,cve-2026-87028,">
  <rule id="2026870" level="8">
    <if_sid>31100</if_sid>
    <id>^20[0-9]$</id>
    <url>preview</url>
    <url>InstanceItem</url>
    <description>CVE-2026-87028: Possible Concrete CMS custom-slot preview InstanceItem authorization bypass attempt ($(url))</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87028,pci_dss_10.2.4,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, advisory, or commit is available in the tracked data; the following are compensating controls only.

1. Immediate mitigations (compensating controls):

   • Restrict and audit assignment of the edit-board-contents permission. Grant it only to trusted, vetted users, since the entire attack prerequisite is holding this permission on any single board instance.
   • Where feasible, disable or place the custom-slot preview functionality behind administrative-only access until a fix is available.
   • Enforce a web application firewall rule to alert on or block requests to the preview endpoint carrying InstanceItem identifiers from users who do not own the referenced board (requires mapping user→board ownership at the edge).
   • Apply the site-level principle of least privilege: ensure restricted/unpublished pages are genuinely access-controlled in addition to relying on the board feature, since the second flaw skips page-view permission.
   • Enable verbose authorization logging on the preview endpoint and monitor for cross-instance identifier submission.

2. Patch / upgrade steps:

   • Monitor the Concrete CMS security advisories and release notes for a fix that adds board-instance ownership validation to the custom-slot preview endpoint and enforces page-view permission before generating summary content. As of this writing, no patched version is identified in tracked sources.
   • When a fix is released, upgrade Concrete CMS to the patched release and remove any temporary WAF/disablement mitigations.

3. Long-term hardening:

   • Adopt object-level authorization (ownership checks) as a mandatory pattern for every endpoint that accepts an object identifier.
   • Enforce page-view permission checks on all content-generation paths, including preview/summary endpoints.
   • Deploy automated authorization test coverage (IDOR/broken-object-level-authorization regression suites) in CI/CD.
   • Maintain an inventory of all endpoints that return page metadata and review them for consistent access control.

References

1. NVD — CVE-2026-87028: https://nvd.nist.gov/vuln/detail/CVE-2026-87028
2. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. Concrete CMS Security Advisories (monitor for the fix advisory): https://www.concretecms.org/about/project-news/security
4. FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87028 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. No public PoC, no Nuclei template, no exploit code, and no CISA KEV entry exist for this CVE. Credit for reporting goes to Pakung. The attack chain is inferred from the vulnerability class and the NVD description; no active exploitation campaigns are known.