anonhaven

CVE-2026-81924

LOW CVSS 4.0: 2.1
Updated Sep 15, 2026
Concrete
Parameter Value
CVSS 2.1 (LOW)
Affected Versions before 9.5.3
Type CWE-352 (Cross-Site Request Forgery (CSRF))
Vendor Concrete
Public PoC No

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controller's activate_files() action created PageTemplate records from attacker-supplied pageTemplates[] values without validating an anti-CSRF token.A remote attacker could host a page that auto-submitted a forged POST request; when a signed-in administrator visited it, the request executed under the administrator's session and created theme page-template records, changing site configuration without the administrator's consent. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N.

Thanks Andrew Gonzalez for reporting.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-352 Cross-Site Request Forgery (CSRF)

References 1

https://documentation.concretecms.org/developers/introduction/version-history/9…
ff5b8ace-8b95-4078-9743-eac1ca5451de
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-81927

Concrete

1.8

CVE-2026-81926

Concrete

2.0

CVE-2026-18425

Concrete

2.1

CVE-2026-18424

Concrete

2.1

CVE-2026-81922

Concrete

2.1