Vulnerability Description
Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an authenticated user holding edit-board-contents permission on a single board instance could submit the identifier of an item belonging to a different board instance and receive summary fields, including the page title and description, of an underlying page the same user was otherwise forbidden to view. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Pakung for reporting.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-87028?
CVE-2026-87028 is a documented vulnerability. Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did ...
How severe is CVE-2026-87028?
CVSS scoring is not yet available for CVE-2026-87028. Check NVD for updates.
Is there a patch for CVE-2026-87028?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.