CVE-2026-81905
Received Received - Intake

Concrete CMS Hash Type Confusion Vulnerability

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued for one purpose can be redeemed for another: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to set a new password on the target account, and a password-reset hash can be submitted to the email-validation endpoint to activate an account. Exploitation requires the attacker to first obtain a valid hash through a separate channel (for example email interception, log exposure, or SSRF against an internal mail relay), so the flaw amplifies the impact of any hash disclosure rather than creating a standalone entry point. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-81905
EUVD
EUVD-2026-75887

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS versions below 9.5.3 store user validation hashes for email validation, password reset, and persistent login in a single table without proper type verification. This allows a hash meant for one purpose to be used for another, such as using a registration hash to change a password or a password-reset hash to activate an account.

Detection Guidance

Detection requires checking for Concrete CMS versions below 9.5.3 and reviewing hash handling in the database. Look for suspicious password reset or email validation activities. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to gain unauthorized access to user accounts by intercepting hashes through methods like email interception or SSRF attacks. This could lead to account takeover, data breaches, or unauthorized actions on behalf of users.

Compliance Impact

This vulnerability could lead to unauthorized account access or changes, potentially violating data protection principles under GDPR (e.g., integrity and confidentiality) and HIPAA (e.g., unauthorized access to protected health information). Exploitation requires prior hash disclosure, but the flaw amplifies risks of non-compliance if such disclosures occur.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later to address the hash validation flaw. Review and restrict access to hash values in logs and emails to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81905. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart