CVE-2026-81915 Concrete CMS CVE debrief

Who should care

Defenders responsible for Concrete CMS deployments should assess exposure and prioritize patching to prevent potential unauthorized modifications to Page Types. This includes verifying the current version of Concrete CMS, reviewing access controls for Page Type updates, and monitoring for suspicious activity related to Page Type modifications. Additionally, defenders should consider the operational impacts of this vulnerability, such as potential security

Why it matters

CVE-2026-81915 is a medium-severity vulnerability in Concrete CMS that allows a signed-in dashboard user to modify Page Types outside their assigned authorization boundary, requiring defenders to verify and apply the patch.

• Potential unauthorized modifications to Page Types
• Verification of patch application priority
• Monitoring for suspicious Page Type modification activity

Technical summary

The Types::submit() dashboard controller in Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type is updated. A signed-in dashboard user permitted to edit one Page Type could modify the configuration of Page Types outside their assigned authorization boundary due to the update_page_type token being validated but action- and user-scoped rather than object-scoped. This oversight allows for potential unauthorized modifications to Page Types, highlighting a critical security gap that needs immediate attention.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential unauthorized modifications to Page Types.

Recommended defensive actions

• Verify and apply the patch to Concrete CMS
• Restrict access to Page Type updates to authorized users
• Monitor for suspicious activity related to Page Type modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by Andrew Gonzalez and has a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. The evidence provided by Andrew Gonzalez indicates a lack of object-level authorization in the Types::submit() dashboard controller of Concrete CMS below version 9.5.3, which allows a signed-in dashboard user permitted to edit one Page Type to modify the configuration of Page Types outside their assigned authorization boundary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.