CVE-2026-81909 Details
Description
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php).It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the source block. A user granted only an area-scoped add_block_to_area delegation on their own page can therefore pass any block ID on the site: the source block's content is duplicated into an area the rogue editor controls, disclosing that content, and the original block is then force-deleted in the same request, destroying arbitrary site content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
A vulnerability in Concrete CMS versions 9.0 through 9.5.2 allows for missing authorization in the block alias route. The issue arises in the Process::alias() method within the backend block controller. The vulnerability does not ensure that the referenced block is truly orphaned on the target page or that the user has permissions for the source block. As a result, a user with an area-scoped add_block_to_area delegation on their own page can manipulate block IDs across the site. This exploitation duplicates the source block's content into an area controlled by the user, inadvertently disclosing that content, while simultaneously force-deleting the original block, thereby destroying arbitrary site content.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes | ConcreteCMS | Broken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | ConcreteCMS |
Affected Products
| Product | Versions |
|---|---|
| Concrete CMS | >= 9, <= 9.5.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | New CVE Received | ConcreteCMS |
| Sep 11, 2026 | CVE Modified | CISA-ADP |