Uncontrolled Asset Registration in Concrete CMS by Concrete5

CVE-2026-81904

What is CVE-2026-81904?

Concrete CMS versions prior to 9.5.3 expose a critical vulnerability where registered view assets for sub-blocks of Stacks, Containers, or layout areas are created without proper permission checks. This flaw allows an unauthenticated attacker to access configuration values from restricted sub-blocks, such as sensitive data including the site's Google Maps API key. As these assets can be fetched from any public page with an embedded affected layout, this represents a significant risk, particularly for sites leveraging protected configurations. Prompt attention and updates to version 9.5.3 or later are recommended to mitigate this exposure.

References