Concrete CMS Sub-Block Asset Exposure via Unauthenticated Access

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: ConcreteCMS

Description

Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration — such as a site's configured Google Maps API key — from any public page embedding an affected Stack, Container, or layout area, despite the block-level permission restriction. Any sub-block type whose asset or header hooks output configuration values is affected. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-81904

Affected Vendors & Products

Vendor	Product	Version / Range
concrete_cms	concrete_cms	to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Concrete CMS versions below 9.5.3 had a flaw where view assets for every sub-block in a Stack, Container, or layout area were registered without checking user permissions. This allowed unauthenticated visitors to access configuration values from restricted sub-blocks, such as API keys, even on public pages.

Impact Analysis

An attacker could exploit this to recover sensitive configuration values like API keys from restricted blocks. This could lead to unauthorized access to services or data tied to those keys, compromising the security of the CMS and its integrations.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later to address the vulnerability. Check the Concrete CMS release notes for version 9.5.3 for further details.

Hi! I’m here to help you understand CVE-2026-81904. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70