CVE-2026-81912

    Dashboard / Vulnerabilities / CVE-2026-81912

    CVE-2026-81912

    Published: 11 Sept 2026Last Modified: 12 Sept 2026

    Summary: Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

    Details: Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenticated user who did not initiate it. Because relocating a group under a new parent causes that group's members to inherit the parent's permissions, a forged move can change effective authorization. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

    References: https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81912.json, https://github.com/concretecms/concretecms, https://nvd.nist.gov/vuln/detail/CVE-2026-81912

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    9.5.2
    9.5.1
    9.5.0
    9.5.0RC2
    9.5.0RC1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-81912 | CVE-DB