Authorization Flaw in Concrete CMS Permits Unauthorized Page Property Modifications

CVE-2026-81901

What is CVE-2026-81901?

A serious authorization flaw exists in Concrete CMS from versions 9.2.0 to 9.5.2, where the REST API page update endpoint fails to properly enforce permissions for page properties, templates, and types. Users with only content-editing rights can exploit this vulnerability to modify critical attributes of web pages via the API. This includes the ability to inject unescaped JavaScript into the head of each page, which could execute in the browsers of all visitors, potentially compromising user sessions and allowing unauthorized actions by higher-privileged users.

References