Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81901— Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

Quick assessment

Affected
Concrete CMS Concrete CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Concrete CMS 9.2.0 至 9.5.2 版本中，REST API 的页面更新接口（PUT /ccm/api/1.0/pages/{cID}）未执行关于页面属性、页面模板或页面类型的权限验证。因此，仅被授予页面内容编辑权限的用户可以通过该 API 修改页面的属性、模板和类型，并能够设置 属性。该属性会以未转义的形式渲染到每个页面的 元素中，从而可以在每个访问者（包括具有更高权限的、负责审批页面版本的审核员）的浏览器中持久化执行 JavaScript 代码。 Concrete CMS 安全团队将此漏洞

CVSS 7.2 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81901

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API, and could set the header_extra_content attribute, which is rendered unescaped into the head element of every page, to persist JavaScript that executed in the browser of every visitor, including higher-privileged reviewers who approve the page version. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.2 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Concrete CMS Concrete CMS 9.2.0 ~ 9.5.2 -

II. Public POCs for CVE-2026-81901

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81901

请登录查看更多情报信息。

Vendor Pages for CVE-2026-81901 (1)

Same Patch Batch · Concrete CMS · 2026-09-14 · 7 CVEs total

CVE-2026-18117 7.3 HIGH Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name
CVE-2026-81900 7.3 HIGH Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight
CVE-2026-18116 7.3 HIGH Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflo
CVE-2026-81902 7.1 HIGH Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
CVE-2026-18119 7.0 HIGH Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom s
CVE-2026-81903 7.0 HIGH Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon

IV. Related Vulnerabilities

Same product: Concrete CMS
Same vendor: Concrete CMS
Same weakness: CWE-862

V. Comments for CVE-2026-81901

No comments yet

Leave a comment