Vulnerability · Published Sep 11, 2026 · Assigned by ConcreteCMS
CVE-2026-81915In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
Medium 5.1
In plain English
A medium-severity missing authorization in Concrete CMS from Concrete CMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), so a signed-in dashboard user permitted to edit one Page Type could modify the configuration of Page Types outside their assigned authorization boundary. The update_page_type token was validated but is action- and user-scoped rather than object-scoped, so it did not constrain which Page Type could be targeted. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Concrete CMS | Concrete CMS | 5.0.0 – through 9.5.2 |
Weakness: CWE-862, CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N