anonhaven

CVE-2026-81915

MEDIUM CVSS 4.0: 5.1 EPSS 0.37%
Updated Sep 11, 2026
Concrete
Parameter Value
CVSS 5.1 (MEDIUM)
Type CWE-862 (Missing Authorization), CWE-639 (Authorization Bypass)
Vendor Concrete
Public PoC No

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), so a signed-in dashboard user permitted to edit one Page Type could modify the configuration of Page Types outside their assigned authorization boundary. The update_page_type token was validated but is action- and user-scoped rather than object-scoped, so it did not constrain which Page Type could be targeted.

The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-862 Missing Authorization
CWE-639 Authorization Bypass

References 1

https://documentation.concretecms.org/developers/introduction/version-history/9…
ff5b8ace-8b95-4078-9743-eac1ca5451de
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-81913

Concrete

5.3

CVE-2026-81912

Concrete

5.7

CVE-2026-68528

Concrete

6.0

CVE-2026-81906

Concrete

6.3

CVE-2026-81905

Concrete

6.3