https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 08:40:41 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-68527 <p>Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted event occurrence. A user with the &#34;Add Event&#34; permission on a single calendar could read and overwrite events on calendars they were not permitted to access, and could delete an event&#39;s original local occurrence. Publishing the injected version to the live calendar, which demotes the previously approved version, additionally required the actor&#39;s approve_calendar_event workflow rights or an auto-approving workflow. The Concrete CMS Security Team gave this a rank of 5.9 with CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.</p> <p>Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted event occurrence. A user with the &#34;Add Event&#34; permission on a single calendar could read and overwrite events on calendars they were not permitted to access, and could delete an event&#39;s original local occurrence. Publishing the injected version to the live calendar, which demotes the previously approved version, additionally required the actor&#39;s approve_calendar_event workflow rights or an auto-approving workflow. The Concrete CMS Security Team gave this a rank of 5.9 with CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-68527 https://vulnerability.circl.lu/vuln/ghsa-xgrc-pc59-m8cp <p>Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted event occurrence. A user with the &#34;Add Event&#34; permission on a single calendar could read and overwrite events on calendars they were not permitted to access, and could delete an event&#39;s original local occurrence. Publishing the injected version to the live calendar, which demotes the previously approved version, additionally required the actor&#39;s approve_calendar_event workflow rights or an auto-approving workflow. The Concrete CMS Security Team gave this a rank of 5.9 with CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.</p> <p>Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted event occurrence. A user with the &#34;Add Event&#34; permission on a single calendar could read and overwrite events on calendars they were not permitted to access, and could delete an event&#39;s original local occurrence. Publishing the injected version to the live calendar, which demotes the previously approved version, additionally required the actor&#39;s approve_calendar_event workflow rights or an auto-approving workflow. The Concrete CMS Security Team gave this a rank of 5.9 with CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-xgrc-pc59-m8cp