CyberRota Analysis
AI-GeneratedConcrete CMS versions 8.3.0 to 9.5.2 are susceptible to an authorization bypass in the Calendar event edit dialog, allowing users with "Add Event" permissions to access, modify, and delete events across unauthorized calendars. This vulnerability could lead to unauthorized event manipulation and potential data integrity issues. Organizations using affected versions should prioritize patching to mitigate risks associated with unauthorized access and event management.
Original NVD Description
Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted event occurrence. A user with the "Add Event" permission on a single calendar could read and overwrite events on calendars they were not permitted to access, and could delete an event's original local occurrence. Publishing the injected version to the live calendar, which demotes the previously approved version, additionally required the actor's approve_calendar_event workflow rights or an auto-approving workflow. The Concrete CMS Security Team gave this a rank of 5.9 with CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.