CVE-2026-81902: Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current version; blocks not aliased to another page or scrapbook entry were also removed from the global Blocks table and their block-type data table, permanently destroying the content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.2 - Compensating control
Restrict access to the page/block editing functionality used to trigger the orphaned block removal action to trusted users only (users who legitimately need edit permissions), and ensure the action is reachable only from authenticated sessions.
Event History
Frequently Asked Questions
Which users can be targeted by an attacker?
An attacker must cause an authenticated Concrete CMS user who has edit permission on the target page to load a crafted request. No attacker authentication is required.
What content can be lost if exploitation succeeds?
Every block on the target page's current version can be deleted. Blocks that are not aliased to another page or scrapbook entry can also be removed from the global Blocks table and their block-type data table, permanently destroying their content.
Which deployments are affected?
Concrete CMS versions 9.0.0 through 9.5.2 are affected by the missing CSRF-token validation in the orphaned block removal action.