CVE-2026-81909
Deferred Deferred - Pending Action

Missing Authorization in Concrete CMS Block Alias Route

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php).It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the source block. A user granted only an area-scoped add_block_to_area delegation on their own page can therefore pass any block ID on the site: the source block's content is duplicated into an area the rogue editor controls, disclosing that content, and the original block is then force-deleted in the same request, destroying arbitrary site content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-81909
EUVD
EUVD-2026-76168

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms From 9 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS versions 9 through 9.5.2 have a missing authorization issue in the block alias route. The system fails to verify if a referenced block is orphaned or if the user has permission over the source block. This allows a user with limited privileges to manipulate block IDs, duplicate content into their own area, and delete arbitrary site content.

Impact Analysis

An attacker with restricted access could steal sensitive content by duplicating blocks into their own area. They could also destroy important site content by force-deleting blocks they do not own. This could lead to data leaks or site disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and integrity. Organizations using affected Concrete CMS versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Update Concrete CMS to version 9.5.3 or later to address the missing authorization issue in the block alias route. Ensure all users have only the necessary permissions and avoid granting area-scoped add_block_to_area delegation unless absolutely required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81909. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart