CVE-2026-81915: In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), so a signed-in dashboard user permitted to edit one Page Type could modify the configuration of Page Types outside their assigned authorization boundary. The updatepagetype token was validated but is action- and user-scoped rather than object-scoped, so it did not constrain which Page Type could be targeted. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Compensating control
Restrict dashboard access so only users within the intended authorization boundary can submit Page Type updates (because Types::submit() can update Page Types identified by a user-supplied ptID without calling canEditPageType()).
Event History
Frequently Asked Questions
What access would an attacker need to exploit this issue?
The attacker must be signed in as a dashboard user and already have permission to edit at least one Page Type. They can then target another Page Type by supplying its ptID during an update request.
What can be modified if the issue is exploited?
An authorized Page Type editor can modify the configuration of Page Types outside their assigned authorization boundary. The issue affects the integrity of Page Type configuration; the provided CVSS vector indicates no confidentiality or availability impact.
Does the update request token prevent this attack?
No. The update_page_type token is scoped to the action and user, but not to the specific Page Type object, so it does not restrict which ptID can be targeted.