Vulnerability Description
In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API, and could set the header_extra_content attribute, which is rendered unescaped into the head element of every page, to persist JavaScript that executed in the browser of every visitor, including higher-privileged reviewers who approve the page version. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.2 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Concretecms | Concrete Cms | >= 9.2.0, < 9.5.3 |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-81901?
CVE-2026-81901 is a vulnerability with a CVSS score of 8.7 (HIGH). In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only cont...
How severe is CVE-2026-81901?
CVE-2026-81901 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-81901?
Check the references section above for vendor advisories and patch information. Affected products include: Concretecms Concrete Cms.