CVE-2026-81915

Analyzed Analyzed - Analysis Complete

Object-Level Authorization Bypass in Concrete CMS

Publication date: 2026-09-11

Last updated on: 2026-09-24

Assigner: ConcreteCMS

Description

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), so a signed-in dashboard user permitted to edit one Page Type could modify the configuration of Page Types outside their assigned authorization boundary. The update_page_type token was validated but is action- and user-scoped rather than object-scoped, so it did not constrain which Page Type could be targeted. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-24

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-81915

EUVD

EUVD-2026-76249

Affected Vendors & Products

Vendor	Product	Version / Range
concretecms	concrete_cms	to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Concrete CMS versions below 9.5.3 lack object-level authorization checks when updating Page Types. The dashboard controller updates a Page Type based on a user-supplied ID without verifying if the user has permission to edit that specific Page Type. This allows a signed-in user with access to edit one Page Type to modify others outside their authorized scope.

Detection Guidance

This vulnerability can be detected by checking the Concrete CMS version. If your system is running a version below 9.5.3, it is vulnerable. Use commands like 'concrete/bin/concrete version' or check the version in the admin dashboard.

Impact Analysis

An attacker with dashboard access could escalate privileges by modifying Page Type configurations beyond their intended scope. This could lead to unauthorized changes in website behavior, data exposure, or further system compromise depending on the Page Type's role.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized modifications to system configurations that handle sensitive data. It may lead to data breaches or improper access controls, potentially violating GDPR's integrity principle or HIPAA's access control requirements.

Mitigation Strategies

Immediately upgrade Concrete CMS to version 9.5.3 or higher to address the authorization flaw. Ensure proper access controls are in place for dashboard users to prevent unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-81915. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70