Concrete CMS up to 9.5.2 Block Alias process.php Process::alias improper authorization

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Concrete CMS up to 9.5.2. This affects the function Process::alias of the file concrete/controllers/backend/block/process.php of the component Block Alias. This manipulation causes improper authorization. This vulnerability is tracked as CVE-2026-81909. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Concrete CMS up to 9.5.2. It has been declared as problematic. Affected by this vulnerability is the function Process::alias of the file concrete/controllers/backend/block/process.php of the component Block Alias. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect integrity, and availability. The summary by CVE is:

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php).It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the source block. A user granted only an area-scoped add_block_to_area delegation on their own page can therefore pass any block ID on the site: the source block's content is duplicated into an area the rogue editor controls, disclosing that content, and the original block is then force-deleted in the same request, destroying arbitrary site content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

It is possible to read the advisory at documentation.concretecms.org. This vulnerability is known as CVE-2026-81909 since 08/27/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/11/2026). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

By approaching the search of inurl:concrete/controllers/backend/block/process.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Concrete CMS

Version

• 9.5.0
• 9.5.1
• 9.5.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion