CVE-2026-81904 Details
Description
Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration — such as a site's configured Google Maps API key — from any public page embedding an affected Stack, Container, or layout area, despite the block-level permission restriction. Any sub-block type whose asset or header hooks output configuration values is affected. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
A vulnerability exists in Concrete CMS versions prior to 9.5.3, where registered view assets for each sub-block of a Stack, Container, or layout area were made without verifying if the user could view that sub-block. This flaw allowed an unauthenticated visitor to access configuration values from a restricted sub-block's asset registration, such as a Google Maps API key, through any public page that included the affected Stack, Container, or layout area. The vulnerability bypassed block-level permission restrictions and affected sub-block types that output configuration values in their asset or header hooks.
Users can upgrade to Concrete CMS version 9.5.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://documentation.concretecms.org/9-x/developers/introduction/version-history/953-release-notes | ConcreteCMS | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | ConcreteCMS |
Affected Products
| Product | Versions |
|---|---|
| Concrete CMS | < 9.5.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | New CVE Received | ConcreteCMS |