CVE-2026-81919: Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint
Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an attacker could induce a signed-in content editor into loading an attacker-controlled page that auto-submitted a cross-site request and reordered or moved blocks in the draft version of a page the victim was permitted to edit. The default null cookie SameSite configuration let the victim's session cookie accompany the forged request. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Compensating control
Harden session cookies to prevent them from being sent on cross-site requests: set the session cookie SameSite configuration to a restrictive value (the report notes the default null SameSite configuration allowed the victim's session cookie to accompany the forged CSRF request).
Event History
Frequently Asked Questions
Who can be affected by this issue?
The attack requires a signed-in Concrete CMS content editor who has permission to edit the targeted page. The resulting unauthorized change is limited to reordering or moving blocks in that editor's permitted page draft.
What does an attacker need to exploit it?
An attacker needs to get an authenticated editor to load an attacker-controlled page that submits a cross-site request to the block-arrangement endpoint. No attacker authentication is required, but the victim must interact with the malicious page while signed in.
Are default installations affected?
Yes. The described default null SameSite cookie configuration allows the victim's session cookie to be included with the forged request.
What should be done if an immediate upgrade is not possible?
The provided information does not specify a workaround. Reducing exposure would require preventing authenticated editors from being induced to visit untrusted pages, but the available data does not identify a configuration-based mitigation.