CSRF Vulnerability in Concrete CMS Affects Content Management Capabilities

CVE-2026-81902

What is CVE-2026-81902?

Concrete CMS versions 9 through 9.5.2 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The issue arises from the lack of proper validation of CSRF tokens in the orphaned block removal panel. A remote attacker can exploit this vulnerability by sending a crafted request designed to be executed by an authenticated user with edit permissions on the affected page. Upon such execution, the user may inadvertently trigger the deletion of all blocks associated with the current page version. This not only results in the loss of content that is not linked to any other page or scrapbook entry but also removes these blocks permanently from the global Blocks table and their corresponding block-type data table, creating a risk of irreversible data loss.

References