CVE-2026-81915
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), so a signed-in dashboard user permitted to edit one Page Type could modify the configuration of Page Types outside their assigned authorization boundary. The update_page_type token was validated but is action- and user-scoped rather than object-scoped, so it did not constrain which Page Type could be targeted. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- CWE
- CWE-862, CWE-639
- Published
- 2026-09-11
- Last modified
- 2026-09-11
Affected products
- Concrete CMS Concrete CMS
Weakness type
Related vulnerabilities
- CVE-2026-62089 — WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability
- CVE-2026-62137 — WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability
- CVE-2026-62136 — WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability
- CVE-2026-62135 — WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability
- CVE-2026-62132 — WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability
- CVE-2026-62114 — WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability
- CVE-2026-27378 — WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability
- CVE-2026-81909 — Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks