CVE-2026-81905: Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued for one purpose can be redeemed for another: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to set a new password on the target account, and a password-reset hash can be submitted to the email-validation endpoint to activate an account. Exploitation requires the attacker to first obtain a valid hash through a separate channel (for example email interception, log exposure, or SSRF against an internal mail relay), so the flaw amplifies the impact of any hash disclosure rather than creating a standalone entry point. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3
Event History
Frequently Asked Questions
What must an attacker obtain before this issue can be exploited?
The attacker must first obtain a valid user validation hash through another channel, such as email interception, log exposure, or SSRF against an internal mail relay. No authenticated account is required to redeem a disclosed hash.
What are the practical account-impact scenarios?
A long-lived registration hash can be submitted to the password-change endpoint to set a new password for the target account. A password-reset hash can be submitted to the email-validation endpoint to activate an account.
Which disclosed hashes create the longest exposure window?
Registration hashes are described as having a 60-day expiry, making their disclosure particularly significant because they can be used at the password-change endpoint. The issue increases the impact of hash leaks rather than providing an independent way to obtain hashes.
What version should be used to address the issue?
Deploy Concrete CMS 9.5.3 or later. Versions below 9.5.3 are affected.