CVE-2026-81913

Received Received - Intake

Open Redirect in Concrete CMS

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow, giving a second entry point on sites with registration enabled. Concrete CMS versions prior to 9.5.0 do not include the rcURL parameter or this allowlist and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Michal M. for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-81913

EUVD

EUVD-2026-76245

Affected Vendors & Products

Vendor	Product	Version / Range
concrete_cms	concrete_cms	From 9.5.0 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

Concrete CMS versions 9.5.0 through 9.5.2 have an Open Redirect vulnerability via the rcURL parameter. An attacker can create a link on the site that redirects users to an external site immediately after authentication, which can be used for phishing or stealing credentials. The same issue exists in the registration flow if registration is enabled.

Detection Guidance

To detect this vulnerability, inspect Concrete CMS versions 9.5.0 through 9.5.2 for the presence of the rcURL parameter in authentication or registration flows. Check server logs for unusual redirects to external domains immediately after login or registration. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows attackers to trick users into visiting malicious sites after login or registration, potentially leading to credential theft, phishing attacks, or malware installation. Users may unknowingly share sensitive information on fake but legitimate-looking sites.

Mitigation Strategies

Upgrade Concrete CMS to a version prior to 9.5.0 or apply the latest patch to remove the rcURL parameter handling. Disable registration if not needed. Monitor for unauthorized redirects and review access logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-81913. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70