CVE-2026-81924 Concrete CMS CVE debrief

Who should care

Administrators and users of Concrete CMS versions before 9.5.3 should assess their exposure and update to the latest version to prevent exploitation of this CSRF vulnerability. This includes reviewing system configurations, ensuring proper security measures are in place, and monitoring for any suspicious activity related to theme page-template records. Additionally, security teams should verify that appropriate compensating controls are implemented for any

Why it matters

This CSRF vulnerability in Concrete CMS before version 9.5.3 allows an attacker to create theme page-template records without an administrator's consent, potentially changing site configuration. Administrators and users should assess their exposure and update to the latest version to prevent exploitation.

• An attacker could change site configuration without an administrator's consent by creating theme page-template records.
• The vulnerability requires user interaction, as the attacker needs to trick a signed-in administrator into visiting a malicious page.
• The impact is limited to the creation of theme page-template records, with no evidence of arbitrary code execution or data theft.

Technical summary

The vulnerability exists in the Dashboard theme Inspect controller's activate_files() action, which creates PageTemplate records from attacker-supplied pageTemplates[] values without validating an anti-CSRF token. This allows a remote attacker to host a page that auto-submits a forged POST request, which executes under the administrator's session when visited, potentially changing site configuration. The vulnerability requires user interaction, as the attacker needs to trick a signed-in administrator into visiting a malicious page. The impact is limited to the creation of theme page-template records, with no evidence of arbitrary code execution or data theft. The CVSS v4.0 score is 2.1 with vector CVSS:4.0/AV:N

Defensive priority

Low

Recommended defensive actions

• Review and update Concrete CMS to version 9.5.3 or later
• Implement CSRF protection for theme page-template activation
• Monitor for suspicious activity related to theme page-template records
• Confirm whether affected Concrete CMS deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details about the CSRF vulnerability in Concrete CMS before version 9.5.3. The vulnerability allows an attacker to create theme page-template records without an administrator's consent by exploiting the theme page-template activation feature.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.