CVE-2026-18423
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres
CVSS score
2.1
EPSS probability
%0.2
Risk score
0.0
Published
1 mo ago
Vulnerability Timeline (Change History)
CVE-2026-18423 historical changes made to the vulnerability by NVD, CISA and MITRE:
| Date | Actor / Source | Action / Description | Type | Previous value | New value |
|---|---|---|---|---|---|
| 21.09.2026 | nvd@nist.gov | Initial Analysis & CVSS Vector Assignment | CVSS V3.1 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N |
| 15.09.2026 | CISA Coordinator | SSVC Risk Re-assessment | SSVC / KEV | exploitation: none | exploitation: none |
| 15.09.2026 | MITRE / NVD | New CVE Record Received & Ingested | CVE Created | — | CVE-2026-18423 |
Similar Vulnerabilities
7.2
CVE-2026-8134Unrestricted file upload in Concretecms Concrete Cms
Patch status unknownEPSS %1
5.3
CVE-2026-6826Information exposure in Concretecms Concrete Cms
Patch status unknown Public Exploits:1EPSS %1
7.2
CVE-2026-8135Deserialization of untrusted data in Concretecms Concrete Cms
Patch status unknownEPSS %1
8.8
CVE-2026-8350Incorrect authorization in Concretecms Concrete Cms
Patch status unknownEPSS %0
5.3
CVE-2026-8237Missing authorization in Concretecms Concrete Cms
Patch status unknown Public Exploits:2EPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-18423"