Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81912— Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Quick assessment

Affected
Concrete CMS Concrete CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Concrete CMS 在 9.5.3 版本之前存在跨站请求伪造（CSRF）漏洞，受影响的功能是“批量移动组”（Move Multiple Groups）。具体来说， 端点在移动所选的组树节点时，未验证操作令牌（action token），因此攻击者可以诱使一个已认证用户执行其本人并未主动发起的组移动操作，且该状态变更会被服务器处理。 由于将组移动到新的父节点下会导致该组成员继承新父节点的权限，一次伪造的移动操作可能会改变用户的有效授权状态。 Concrete CMS 安全团队为此漏洞分配了 CVSS v4.0

CVSS 5.7 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
Concrete CMS Concrete CMS 5.0.0≤ 9.5.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81912

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature
Source: CVE Program / CVE List V5
Vulnerability Description
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenticated user who did not initiate it. Because relocating a group under a new parent causes that group's members to inherit the parent's permissions, a forged move can change effective authorization. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Concrete CMS Concrete CMS 5.0.0 ~ 9.5.2 -

II. Public POCs for CVE-2026-81912

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81912

请登录查看更多情报信息。

Vendor Pages for CVE-2026-81912 (1)

Same Patch Batch · Concrete CMS · 2026-09-11 · 10 CVEs total

CVE-2026-81908 6.0 MEDIUM Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows
CVE-2026-18122 6.0 MEDIUM Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entr
CVE-2026-68528 6.0 MEDIUM Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unesca
CVE-2026-81909 5.9 MEDIUM Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block
CVE-2026-81910 5.9 MEDIUM Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in The
CVE-2026-81911 5.8 MEDIUM Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save
CVE-2026-81913 5.3 MEDIUM Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL pa
CVE-2026-68526 5.3 MEDIUM Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog con
CVE-2026-81915 5.1 MEDIUM In Concrete CMS below 9.5.3, Page Type update omits object-level authorization

IV. Related Vulnerabilities

Same product: Concrete CMS
Same vendor: Concrete CMS
Same weakness: CWE-352

V. Comments for CVE-2026-81912

No comments yet

Leave a comment