CVE-2026-81913— Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.
Quick assessment
Affected
Concrete CMS Concrete CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Concrete CMS 9.5.0 至 9.5.2 版本中的 参数存在开放重定向漏洞。攻击者可以构造一个位于网站自身域名下的单一链接，使用户在认证后立即被重定向到任意外部站点，从而便于实施钓鱼攻击和凭证窃取。在启用了注册功能的站点上，注册流程中采用了相同的处理逻辑，提供了第二个入口点。Concrete CMS 9.5.0 之前的版本不包含 参数或相关白名单机制，因此不受该漏洞影响。Concrete CMS 安全团队为此漏洞赋予的 CVSS v4.0 得分为 5.3，向量表示为 CVSS:4.0/AV:N/AC:L
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Concrete CMS | Concrete CMS | 9.5.0≤ 9.5.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81913
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.
Source: CVE Program / CVE List V5
Vulnerability Description
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow, giving a second entry point on sites with registration enabled. Concrete CMS versions prior to 9.5.0 do not include the rcURL parameter or this allowlist and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Michal M. for reporting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Concrete CMS | Concrete CMS | 9.5.0 ~ 9.5.2 | - |
|
II. Public POCs for CVE-2026-81913
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81913
请登录查看更多情报信息。
Vendor Pages for CVE-2026-81913 (1)
-
🔗 Page Not Found :: Concrete CMS release-notes
Same Patch Batch · Concrete CMS · 2026-09-11 · 10 CVEs total
| CVE-2026-81908 | 6.0 MEDIUM | Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows |
| CVE-2026-18122 | 6.0 MEDIUM | Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entr |
| CVE-2026-68528 | 6.0 MEDIUM | Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unesca |
| CVE-2026-81909 | 5.9 MEDIUM | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block |
| CVE-2026-81910 | 5.9 MEDIUM | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in The |
| CVE-2026-81911 | 5.8 MEDIUM | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save |
| CVE-2026-81912 | 5.7 MEDIUM | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple |
| CVE-2026-68526 | 5.3 MEDIUM | Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog con |
| CVE-2026-81915 | 5.1 MEDIUM | In Concrete CMS below 9.5.3, Page Type update omits object-level authorization |
IV. Related Vulnerabilities
Same product: Concrete CMS
-
CVE-2026-81915
In Concrete CMS below 9.5.3, Page Type update omits object- -
CVE-2026-68526
Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calen -
CVE-2026-81912
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Reques -
CVE-2026-81911
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored -
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Te
Same vendor: Concrete CMS
-
CVE-2026-81915
In Concrete CMS below 9.5.3, Page Type update omits object- -
CVE-2026-68526
Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calen -
CVE-2026-81912
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Reques -
CVE-2026-81911
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored -
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Te
Same weakness: CWE-601
-
CVE-2026-54072
Authorizer: Unvalidated redirect_uri in /authorize leaks OAu -
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Hea -
CVE-2026-88882
Renovate before 44.11.2 Credential Exfiltration via Link Hea -
CVE-2026-88881
Renovate before 44.11.3 Credential Exfiltration via Link Hea -
CVE-2026-88880
Renovate before 44.11.3 Credential Exfiltration via Link Hea
V. Comments for CVE-2026-81913
No comments yet