CVE-2026-81924 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation
Remote attackers can trick administrators into activating unauthorized theme page templates, altering site configuration without consent.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81924?
CVE-2026-81924 is a low-severity vulnerability in Concretecms Concrete Cms, published on 15 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controller's activate_files() action created PageTemplate records from attacker-supplied pageTemplates[] values without validating an anti-CSRF token.A remote attacker could host a page that auto-submitted a forged POST request; when a signed-in administrator visited it, the request executed under the administrator's session and created theme page-template records, changing site configuration without the administrator's consent. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
Weakness: CWE-352
Which versions are affected by CVE-2026-81924?
It affects 1 product.
Products include Concretecms Concrete Cms.
How do I fix CVE-2026-81924?
No fix has been published for CVE-2026-81924 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81924 being exploited?
There is no known exploitation of CVE-2026-81924 in the wild and no public exploit code.
Other vulnerabilities in Concretecms Concrete Cms
- CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- CVE-2022-21829 Code injection in concrete CMS
- CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5
- CVE-2021-40098 Path traversal in n/a
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
Sources
Also known as GHSA-vpqj-cqpc-pm26.