CVE-2026-81907

Received Received - Intake

Cross-Site Request Forgery in Concrete CMS

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation to proceed when the token is missing or invalid. A remote unauthenticated attacker can force an authenticated administrator who visits an attacker-controlled page to permanently delete all entries belonging to an attacker-selected Express entity on a web application to which the administrator is currently authenticated. Because the default Contact Express object ships with a fixed entity UUID, the target identifier can be obtained without dashboard access. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Pratik Zanjurne for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-81907

Affected Vendors & Products

Vendor	Product	Version / Range
concrete_cms	concrete_cms	to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Concrete CMS 9.5.2 and below has a Cross-Site Request Forgery (CSRF) vulnerability in the Express 'Clear Entries' function. The system fails to enforce a failed CSRF token check, allowing destructive operations to proceed even when the token is missing or invalid. This lets a remote unauthenticated attacker trick an authenticated administrator into deleting all entries of a specific Express entity by visiting a malicious page.

Detection Guidance

This vulnerability can be detected by monitoring for unexpected POST requests to /index.php/dashboard/system/express/entities/delete_entries without a valid CSRF token. Check web server logs for suspicious activity targeting this endpoint. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to permanently delete all entries in a targeted Express entity on your Concrete CMS site. Since the default Contact Express object has a fixed UUID, attackers can identify targets without needing dashboard access. This could lead to loss of important data, including user contacts or other critical information stored in Express entities.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized data deletion. An attacker could force an administrator to delete Express entity entries, which may include sensitive data such as user contacts or records. Loss of such data could violate GDPR's data integrity and availability principles or HIPAA's requirements for protecting health information.

Mitigation Strategies

Upgrade Concrete CMS to a version higher than 9.5.2 where the CSRF token check is properly enforced in the Express Clear Entries function to prevent unauthorized deletion of entries.

Hi! I’m here to help you understand CVE-2026-81907. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70