CVE-2026-81912: Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenticated user who did not initiate it. Because relocating a group under a new parent causes that group's members to inherit the parent's permissions, a forged move can change effective authorization. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Configuration
Update dashboard/users/groups/bulkupdate/confirm() to validate an action token before processing the state-changing Move Multiple Groups group-tree move (to prevent CSRF from moving group nodes without a valid token).
Concrete CMS dashboard/users/groups/bulkupdate/confirm() endpoint action token validation = enabled
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Authenticated users with the high privileges needed to move groups are exposed if they can be induced to submit a forged request. The impact is greatest where moving a group beneath another group would grant its members more permissive inherited access.
What does an attacker need to exploit it?
An attacker needs an authenticated, privileged Concrete CMS user to interact with a forged request. The CVSS vector indicates network access, low attack complexity, required user interaction, and high privileges.
Are default installations affected?
The provided information identifies all Concrete CMS versions before 9.5.3 as vulnerable, but does not state whether the affected group-management capability is enabled or reachable in a default installation.
What is the remediation?
Update Concrete CMS to version 9.5.3 or later. The vulnerable endpoint is dashboard/users/groups/bulkupdate/confirm(), which lacked action-token validation for bulk group moves.
How can administrators assess whether they may have been affected?
Review group hierarchy changes and resulting inherited permissions for unexpected relocations of groups under new parent groups. Pay particular attention to moves that caused group members to gain access through the parent group's permissions.