CVE-2026-81902

Received Received - Intake

CSRF Token Validation Flaw in Concrete CMS

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: ConcreteCMS

Description

Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current version; blocks not aliased to another page or scrapbook entry were also removed from the global Blocks table and their block-type data table, permanently destroying the content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-81902

Affected Vendors & Products

Vendor	Product	Version / Range
concrete_cms	concrete_cms	From 9 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Concrete CMS versions 9 through 9.5.2 had a vulnerability where the CSRF token was not validated in the orphaned block removal panel action. This allowed a remote attacker to craft a request that, when loaded by an authenticated user with edit permissions, would delete all blocks on the current page version. Blocks not linked to other pages or scrapbooks were permanently removed from the global Blocks table and their associated data tables, causing irreversible content destruction.

Detection Guidance

This vulnerability can be detected by checking Concrete CMS versions for 9 through 9.5.2. Look for unauthorized removal of blocks or content from pages. Review server logs for suspicious requests targeting the removeOrphanedBlocks action.

Impact Analysis

If exploited, this vulnerability could lead to complete loss of content on affected pages. Users with edit permissions could unknowingly trigger the deletion of all blocks, including those shared across pages, resulting in permanent data loss and disruption of website functionality.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by causing unauthorized deletion of sensitive or regulated data. Permanent loss of content may violate retention policies, data integrity requirements, or breach obligations to maintain accurate records.

Mitigation Strategies

Immediately update Concrete CMS to a version beyond 9.5.2. If updating is not possible, disable the removeOrphanedBlocks action or restrict edit permissions to trusted users. Monitor for signs of block removal or content deletion.

Hi! I’m here to help you understand CVE-2026-81902. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70