CVE-2026-68526

    Dashboard / Vulnerabilities / CVE-2026-68526

    CVE-2026-68526

    Published: 11 Sept 2026Last Modified: 12 Sept 2026

    Summary: Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller

    Details: Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission, so a crafted cross-site request could cause an authenticated user with add-event permission to create duplicate CalendarEvents and CalendarEventVersions records under their own authority. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

    References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/953-release-notes, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68526.json, https://github.com/concretecms/concretecms, https://nvd.nist.gov/vuln/detail/CVE-2026-68526

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8fe9708072c3815a5df719b592e4b23b43b4ff7a
    Fixed -None

    Affected versions

    9.5.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-68526 | CVE-DB