Concrete CMS: 21 Vulnerabilities Including XSS and Auth Bypass Disclosed Together
A batch of 21 vulnerabilities, including XSS, CSRF, and authorization bypasses, were disclosed for Concrete CMS versions prior to 9.5.3, all patched in release 9.5.3.
Key findings
- 21 vulnerabilities disclosed for Concrete CMS versions prior to 9.5.3 between Sept 8-11, 2026.
- Flaws include Stored XSS, CSRF, authorization bypasses, and SSTI.
- Multiple vulnerabilities stem from inadequate authorization checks in various modules.
- Stored XSS found in Page Attribute Display, Document Library, and Board Custom Slot blocks.
- CSRF vulnerabilities affect Express entries, group moves, and dialog controllers.
- All disclosed issues are fixed in Concrete CMS version 9.5.3.
On September 11, 2026, a significant batch of 21 vulnerabilities was disclosed for Concrete CMS, affecting versions prior to 9.5.3. These vulnerabilities, spanning a three-day disclosure window from September 8th to 11th, 2026, primarily revolve around authorization bypasses, cross-site scripting (XSS), and cross-site request forgery (CSRF) flaws. The sheer volume and variety of these issues highlight potential systemic weaknesses in how permissions and data sanitization are handled within the CMS.
Several vulnerabilities stem from inadequate authorization checks. CVE-2026-81916 describes how Concrete CMS before 9.5.3 failed to perform object-level authorization when a Page Type was updated, allowing users to modify page types they shouldn't have access to. Similarly, CVE-2026-81909 points to a missing authorization flaw in the block alias route, enabling users to alias blocks without proper permissions. The REST API is also affected, with CVE-2026-68528 and CVE-2026-18122 detailing missing authorization in the Groups list endpoint and Express REST API list endpoint, respectively, potentially exposing restricted data. CVE-2026-18121 further exacerbates this by allowing unauthorized viewing of calendar event occurrences.
Cross-Site Scripting (XSS) vulnerabilities were also prevalent. CVE-2026-81918 details a Stored XSS vulnerability in the Date Format field of the Page Attribute Display block, allowing authenticated users to inject malicious scripts. CVE-2026-81917 highlights another Stored XSS flaw in the Document Library block, where file descriptions and tags were not properly escaped. Additionally, CVE-2026-68528 describes how the RSS Displayer block rendered remote feed item titles without HTML escaping, leading to XSS. CVE-2026-81911 also introduces a Stored XSS vulnerability within the Board Custom Slot dialog.
Cross-Site Request Forgery (CSRF) is another recurring theme. CVE-2026-81907 indicates a CSRF vulnerability in the Express "Clear Entries" function, allowing destructive operations without proper token validation. CVE-2026-81912 points to a CSRF flaw in the "Move Multiple Groups" feature, enabling unauthorized group moves. CVE-2026-68526 and CVE-2026-84432 also detail CSRF vulnerabilities related to the Calendar event duplicate dialog and Boards custom slot dialog, respectively.
Other notable vulnerabilities include CVE-2026-81910, a Server-Side Template Injection (SSTI) flaw in the Theme Customizer via unvalidated style values, and CVE-2026-81913, an Open Redirect vulnerability exploitable via the rcURL parameter, facilitating phishing attacks. CVE-2026-81905 describes a flaw in how user validation hashes were stored and redeemed, potentially allowing hashes for one purpose to be used for another. Finally, CVE-2026-81904 indicates that view assets for sub-blocks within stacks, containers, or layout areas were registered without proper authorization checks, potentially exposing configuration values.
All of these vulnerabilities were addressed in Concrete CMS version 9.5.3, released on September 11, 2026. Users are strongly advised to update to this version to mitigate the risks associated with these numerous security flaws. The broad nature of these issues underscores the importance of regular security audits and prompt patching for Content Management Systems.
The disclosure of these 21 vulnerabilities in close succession highlights a critical period for Concrete CMS users. The range of issues, from XSS and CSRF to authorization bypasses and SSTI, presents a complex threat landscape. Promptly updating to version 9.5.3 is essential to secure installations against these diverse attack vectors. This batch serves as a stark reminder of the ongoing need for vigilance in maintaining the security posture of web applications. ,cve_ids:[