CVE-2026-81919

Received Received - Intake

CSRF in Concrete CMS Block Arrangement

Publication date: 2026-09-15

Last updated on: 2026-09-18

Assigner: ConcreteCMS

Description

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an attacker could induce a signed-in content editor into loading an attacker-controlled page that auto-submitted a cross-site request and reordered or moved blocks in the draft version of a page the victim was permitted to edit. The default null cookie SameSite configuration let the victim's session cookie accompany the forged request. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-18

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-81919

EUVD

EUVD-2026-79142

Affected Vendors & Products

Vendor	Product	Version / Range
concretecms	concrete_cms	to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Concrete CMS versions below 9.5.3 had a vulnerability where an anti-CSRF token was not validated on the block-arrangement backend endpoint. This allowed attackers to trick authenticated content editors into reordering or moving blocks in a page draft they could edit by loading a malicious page that auto-submitted a cross-site request.

Detection Guidance

This vulnerability requires checking Concrete CMS versions and reviewing backend request handling. No direct network detection commands are provided in the context. Verify if your Concrete CMS version is below 9.5.3 and inspect block arrangement endpoint logic for missing CSRF token validation.

Impact Analysis

If you are a content editor using Concrete CMS below 9.5.3, an attacker could manipulate the layout of your page drafts without your knowledge. This could lead to unauthorized changes in page content structure, potentially affecting the integrity of your website's content.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar regulations as it does not involve data breaches or unauthorized data access. However, unauthorized content changes could indirectly affect compliance if they alter required disclosures or data presentation.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later to address the missing anti-CSRF token validation on the block-arrangement endpoint.

Hi! I’m here to help you understand CVE-2026-81919. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70