Cross-Site Request Forgery Vulnerability in Concrete CMS by Concrete5

CVE-2026-81924

What is CVE-2026-81924?

Concrete CMS versions prior to 9.5.3 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability in the activation feature of the theme page-template. The vulnerability exists in the Dashboard theme Inspect controller, where the activate_files() action improperly creates PageTemplate records from unsanitized attacker-supplied pageTemplates[] values due to the absence of anti-CSRF token validation. This flaw enables malicious users to host a webpage that sends a forged POST request. If an administrator accesses this page while logged in, the unauthorized action executes under their session, potentially altering site configurations without the administrator's approval.

References