CVE-2026-81915— In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
Quick assessment
Affected
Concrete CMS Concrete CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Concretely CMS 9.5.3 之前的版本在更新页面类型（Page Type）时未执行对象级授权检查。仪表盘控制器 根据用户提供的 加载并保存了对应的页面类型，但并未调用 进行权限验证。因此，一个已登录的仪表盘用户即使仅被授权编辑某个特定的页面类型，也可能修改其授权范围之外的其他页面类型的配置。虽然 令牌经过了验证，但该令牌是基于操作和用户范围（action- and user-scoped）的，而非基于对象范围（object-scoped），因此它无法限制具体能操作哪个页面类型。 Concrete CM
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Concrete CMS | Concrete CMS | 5.0.0≤ 9.5.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81915
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
Source: CVE Program / CVE List V5
Vulnerability Description
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), so a signed-in dashboard user permitted to edit one Page Type could modify the configuration of Page Types outside their assigned authorization boundary. The update_page_type token was validated but is action- and user-scoped rather than object-scoped, so it did not constrain which Page Type could be targeted. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Concrete CMS | Concrete CMS | 5.0.0 ~ 9.5.2 | - |
|
II. Public POCs for CVE-2026-81915
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81915
请登录查看更多情报信息。
Vendor Pages for CVE-2026-81915 (1)
-
🔗 Page Not Found :: Concrete CMS release-notes
Same Patch Batch · Concrete CMS · 2026-09-11 · 10 CVEs total
| CVE-2026-81908 | 6.0 MEDIUM | Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows |
| CVE-2026-18122 | 6.0 MEDIUM | Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entr |
| CVE-2026-68528 | 6.0 MEDIUM | Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unesca |
| CVE-2026-81909 | 5.9 MEDIUM | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block |
| CVE-2026-81910 | 5.9 MEDIUM | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in The |
| CVE-2026-81911 | 5.8 MEDIUM | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save |
| CVE-2026-81912 | 5.7 MEDIUM | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple |
| CVE-2026-81913 | 5.3 MEDIUM | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL pa |
| CVE-2026-68526 | 5.3 MEDIUM | Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog con |
IV. Related Vulnerabilities
Same product: Concrete CMS
-
CVE-2026-68526
Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calen -
CVE-2026-81913
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to -
CVE-2026-81912
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Reques -
CVE-2026-81911
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored -
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Te
Same vendor: Concrete CMS
-
CVE-2026-68526
Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calen -
CVE-2026-81913
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to -
CVE-2026-81912
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Reques -
CVE-2026-81911
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored -
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Te
Same weakness: CWE-862
-
CVE-2026-62089
WordPress Master Addons for Elementor plugin <= 3.2.2 - Brok -
CVE-2026-62137
WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure -
CVE-2026-62136
WordPress Flexible Quantity – Measurement Price Calculator f -
CVE-2026-62135
WordPress Booktics plugin <= 1.0.24 - Broken Access Control -
CVE-2026-62132
WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Co
V. Comments for CVE-2026-81915
No comments yet