CVE-2026-81924 in Concrete CMS
Summary
by MITRE • 09/15/2026
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controller's activate_files() action created PageTemplate records from attacker-supplied pageTemplates[] values without validating an anti-CSRF token.A remote attacker could host a page that auto-submitted a forged POST request; when a signed-in administrator visited it, the request executed under the administrator's session and created theme page-template records, changing site configuration without the administrator's consent. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
Concrete CMS versions prior to 9.5.3 contain a critical Cross-Site Request Forgery vulnerability within the theme management subsystem, specifically affecting the page-template activation feature. This flaw resides in the Dashboard Inspect controller's activate_files action, which is responsible for creating PageTemplate records based on input values provided by the user. The core technical deficiency lies in the absence of anti-CSRF token validation during this specific operation. Because the server processes these requests without verifying that they originated from a legitimate session initiated by the administrator, it fails to distinguish between authorized administrative actions and maliciously crafted requests generated by external actors. This lack of state-changing request verification allows an attacker to exploit the trust relationship between the browser and the application when a privileged user interacts with a compromised or attacker-controlled web page.
The operational impact of this vulnerability centers on unauthorized modification of site configuration through theme manipulation. A remote attacker can construct a malicious webpage containing auto-submitted POST requests that target the vulnerable activate_files endpoint. When an authenticated administrator, who possesses the necessary privileges to manage themes and templates, visits this malicious page while logged into their Concrete CMS dashboard, the browser automatically includes session cookies with the forged request. Consequently, the server executes the action under the context of the administrator's active session, resulting in the creation or modification of theme page-template records without explicit consent. This effectively allows an attacker to alter the structural and visual configuration of the website, potentially leading to defacement, unauthorized layout changes, or further exploitation vectors depending on how these templates are rendered and utilized within the application logic.
From a classification perspective, this vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery as an attack that forces an end user to execute unwanted actions on a trusted web application in which they are currently authenticated. The exploitation technique corresponds to ATT&CK tactic T1078, specifically the Valid Accounts subtechnique, where attackers leverage legitimate credentials or sessions to perform unauthorized operations. Although the CVSS v4.0 score assigned by the Concrete CMS security team is relatively low at 2.1 due to the requirement for high privileges and user interaction, the potential for configuration drift and integrity compromise remains significant in environments where theme management is a frequent administrative task. The vector indicates that while the attack requires local network access or web delivery (AV:N) and has low complexity (AC:L), it demands privileged user context (PR:H) and relies on user interface deception rather than direct code execution, resulting in limited confidentiality impact but measurable integrity loss for site configuration data.
Mitigation strategies must prioritize immediate patching to version 9.5.3 or later, where the anti-CSRF token validation has been implemented for the activate_files action. In scenarios where upgrading is not immediately feasible, administrators should implement strict access controls and monitor logs for unusual theme modification activities. Additionally, enforcing Content Security Policy headers that restrict form submissions to trusted origins can provide a layer of defense against CSRF attacks by preventing unauthorized cross-origin requests from being processed. Regular security audits focusing on state-changing endpoints are essential to ensure that all administrative actions require proper cryptographic verification of user intent, thereby closing the gap between authenticated sessions and authorized operations.