CVE-2026-81920: Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint
Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-configured reserved-word list (concrete.seo.excludewords) but did not validate the anti-CSRF token that the reset modal emitted, and it did not restrict the request to the POST method. A remote attacker who lured an authenticated user with SEO access to a crafted page could revert the reserved-word list to its default and silently alter future URL-slug generation for pages, files, topics, and other objects created through the Text urlify service, undoing the site's configured SEO slug policy. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Configuration
Update the reset() action for the Dashboard SEO Excluded Words Reset Endpoint so it validates the anti-CSRF token emitted by the reset modal and restricts the request to the POST method; this prevents CSRF from clearing concrete.seo.exclude_words and silently altering future Text urlify URL-slug generation.
Concrete CMS Dashboard SEO Excluded Words reset endpoint (reset() controller action) anti-CSRF token validation and request method restriction = Validate anti-CSRF token and restrict endpoint to POST requests (do not accept non-POST/reset without a valid token).
Event History
Frequently Asked Questions
Who can be targeted by this issue?
An attacker can target an authenticated Concrete CMS user who has access to the Dashboard SEO Excluded Words page. The attacker must lure that user to a crafted remote page.
What conditions are required for exploitation?
No attacker authentication or special privileges are required, but user interaction is required. The targeted user must already be authenticated and have SEO access.
What is the practical effect of a successful attack?
The attack resets the administrator-configured reserved-word list to its default value. This can silently change future URL-slug generation for pages, files, topics, and other objects that use the Text urlify service.
Which versions are affected?
Concrete CMS versions below 9.5.3 are affected. Version 9.5.3 is identified in the provided release-notes reference.