Overview

CVE-2026-8347 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient authorization checks.

When a user reorders associations, the application verifies that the user has permission to view the Express entry but fails to confirm whether the user is authorized to modify it. As a result, an authenticated user with limited privileges can manipulate the identifier of another Express entity and reorder its associations, even without edit permissions.

Unlike SQL Injection or Remote Code Execution vulnerabilities, this flaw does not involve injecting malicious commands or code. Instead, it exploits broken access control by changing a user-controlled object identifier (such as an entity ID) to reference another user's resource. Because the server does not properly validate authorization for the requested object, it performs the action on data the attacker should not be able to modify.

Conceptual vulnerable logic:

// User requests to reorder associations $entityId = $_POST['entityId'];

$entity = $entityRepository->find($entityId);

// Only verifies that the user can access the entity if ($permissionChecker->canView($entity)) {

// Reorders associations without checking edit permission
$associationService->reorder($entity, $_POST['order']);

return response()->json([
    'status' => 'success'
]);

}

Why It Is Vulnerable

The application only validates view permission before performing a state-changing operation.

An attacker can modify the entityId parameter in the request to reference another user's entity. Since no authorization check is performed for the modification itself, the reorder operation succeeds on an unauthorized resource.

Impact

A successful attack may allow an authenticated user to:

• Modify the order of associations belonging to another Express entity.
• Perform unauthorized changes to application data.
• Compromise the integrity of stored information.

The vulnerability primarily affects data integrity and does not inherently allow SQL Injection, Remote Code Execution, or authentication bypass.

Corrected Code (Conceptual)

The application should verify that the authenticated user has permission to modify the specific entity before processing the reorder request.

$entityId = $_POST['entityId'];

$entity = $entityRepository->find($entityId);

// Verify modification permission if (!$permissionChecker->canEdit($entity)) {

return response()->json([
    'error' => 'Access denied.'
], 403);

}

// User is authorized $associationService->reorder($entity, $_POST['order']);

return response()->json([ 'status' => 'success' ]);

Affected Software

• Product: Concrete CMS
• Affected Versions: 9.5.0 and earlier
• Fixed Version: 9.5.1

Mitigation

Upgrade to Concrete CMS 9.5.1 or later. Developers should enforce proper server-side authorization checks for every state-changing request and ensure users can only modify resources they are explicitly permitted to edit.