CVE-2026-81901

Received Received - Intake

Stored XSS in Concrete CMS via Unauthorized REST API Page Updates

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: ConcreteCMS

Description

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API, and could set the header_extra_content attribute, which is rendered unescaped into the head element of every page, to persist JavaScript that executed in the browser of every visitor, including higher-privileged reviewers who approve the page version. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.2 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-81901

Affected Vendors & Products

Vendor	Product	Version / Range
concrete_cms	concrete_cms	From 9.2.0 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Concrete CMS versions 9.2.0 through 9.5.2. The REST API endpoint for updating pages did not properly restrict authorization for page properties, templates, or types. A user with only content-editing rights could exploit this to change page settings and inject malicious JavaScript into the page header via the header_extra_content attribute. This script would execute in the browsers of all visitors, including privileged users.

Detection Guidance

Check Concrete CMS versions between 9.2.0 and 9.5.2. Inspect API logs for unauthorized PUT requests to /ccm/api/1.0/pages/{cID}. Look for suspicious header_extra_content values in page properties that include JavaScript code.

Impact Analysis

An attacker could gain control over a page by injecting persistent JavaScript. This could lead to unauthorized actions, data theft, or defacement. Visitors, including administrators, could have their sessions compromised or be exposed to further attacks through the injected script.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Both standards require protecting data from unauthorized changes and access, which this vulnerability undermines.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later. Review and remove any unauthorized header_extra_content values. Restrict API access to trusted users. Monitor page versions for unexpected changes.

Hi! I’m here to help you understand CVE-2026-81901. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70