Concrete CMS up to 9.5.2 Move Multiple Groups Feature confirm cross-site request forgery

Summaryinfo

A vulnerability was found in Concrete CMS up to 9.5.2. It has been classified as problematic. Affected is the function confirm of the file /users/groups/bulkupdate/confirm of the component Move Multiple Groups Feature. The manipulation leads to cross-site request forgery. This vulnerability is listed as CVE-2026-81912. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Concrete CMS up to 9.5.2. It has been rated as problematic. This issue affects the function confirm of the file /users/groups/bulkupdate/confirm of the component Move Multiple Groups Feature. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. The summary by CVE is:

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenticated user who did not initiate it. Because relocating a group under a new parent causes that group's members to inherit the parent's permissions, a forged move can change effective authorization. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

The advisory is shared at documentation.concretecms.org. The identification of this vulnerability is CVE-2026-81912 since 08/27/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 9.5.3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Name

• Concrete CMS

Version

• 9.5.0
• 9.5.1
• 9.5.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion