CVE-2026-81909: Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php).It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the source block. A user granted only an area-scoped addblocktoarea delegation on their own page can therefore pass any block ID on the site: the source block's content is duplicated into an area the rogue editor controls, disclosing that content, and the original block is then force-deleted in the same request, destroying arbitrary site content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated as an editor and have an area-scoped add_block_to_area delegation on a page they control. They do not need permission over the source block they target.
What impact can a qualifying editor cause?
They can supply any site block ID, copy the source block's content into an area they control, and force-delete the original block in the same request. This enables disclosure and destruction of arbitrary site content.
Does exploitation require another user to interact with the attacker?
No user interaction is required according to the CVSS vector. The attack is network-accessible but requires authenticated, high-privilege access.