CVE-2026-81907: Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records
Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/deleteentries) because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation to proceed when the token is missing or invalid. A remote unauthenticated attacker can force an authenticated administrator who visits an attacker-controlled page to permanently delete all entries belonging to an attacker-selected Express entity on a web application to which the administrator is currently authenticated. Because the default Contact Express object ships with a fixed entity UUID, the target identifier can be obtained without dashboard access. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Pratik Zanjurne for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMS (Express)to a version that resolves this vulnerability.Fixed in 9.5.2
Event History
Frequently Asked Questions
Who is realistically exposed to this attack?
Sites running Concrete CMS 9.5.2 or below are exposed when an authenticated administrator can be induced to visit an attacker-controlled page. The attacker can target the default Contact Express object because its entity UUID is fixed and can be obtained without dashboard access.
What does an attacker need to successfully trigger the deletion?
The attacker does not need authentication or dashboard access. They need an administrator to be currently authenticated to the affected application and to visit a page that submits a request to the Express Clear Entries endpoint.
Are default installations affected?
Yes. The default Contact Express object is specifically reachable because it ships with a fixed entity UUID, allowing an attacker to identify the target without accessing the dashboard.
How can I tell whether this issue could have been exploited?
Review whether the application is running Concrete CMS 9.5.2 or below and inspect Express entities for unexpected or complete deletion of records, particularly the Contact Express object. The provided information does not identify a specific audit-log indicator for successful exploitation.