CVE-2026-81912

Analyzed Analyzed - Analysis Complete

Cross-Site Request Forgery in Concrete CMS

Publication date: 2026-09-11

Last updated on: 2026-09-24

Assigner: ConcreteCMS

Description

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenticated user who did not initiate it. Because relocating a group under a new parent causes that group's members to inherit the parent's permissions, a forged move can change effective authorization. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-24

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-81912

EUVD

EUVD-2026-76243

Affected Vendors & Products

Vendor	Product	Version / Range
concretecms	concrete_cms	to 9.5.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Concrete CMS versions before 9.5.3 have a Cross-Site Request Forgery (CSRF) vulnerability in the Move Multiple Groups feature. The endpoint dashboard/users/groups/bulkupdate/confirm() allows moving group tree nodes without validating an action token. This means an authenticated user could be tricked into allowing unauthorized group relocations, which may change permissions for group members.

Detection Guidance

This vulnerability can be detected by checking the Concrete CMS version. If your system is running a version before 9.5.3, it is vulnerable. No specific commands are provided in the context to detect this vulnerability.

Impact Analysis

An attacker could exploit this to move groups to different locations in the hierarchy, causing members to inherit unintended permissions from their new parent group. This could lead to unauthorized access to sensitive areas or data within Concrete CMS.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized changes to group permissions through forged requests. Since group relocations can alter effective authorization, improper access controls may result in unauthorized data exposure or access, violating compliance requirements for data protection and access management.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later to address the Cross-Site Request Forgery vulnerability in the Move Multiple Groups feature.

Hi! I’m here to help you understand CVE-2026-81912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70