CVE-2026-81901: Concrete CMS REST API XSS Vulnerability

CVE-2026-81901 Overview

CVE-2026-81901 is a missing authorization vulnerability [CWE-862] affecting Concrete CMS versions 9.2.0 through 9.5.2. The REST API page update endpoint PUT /ccm/api/1.0/pages/{cID} fails to enforce page-property, page-template, and page-type authorization checks. A low-privileged user with only content-editing rights can modify page properties, templates, and types through the API. The attacker can set the header_extra_content attribute, which is rendered unescaped into the <head> element of every page. This enables persistent stored cross-site scripting (XSS) that executes in the browsers of all site visitors, including higher-privileged reviewers who approve the modified page version.

Critical Impact
An authenticated editor can achieve stored XSS and escalate privileges by hijacking sessions of reviewers who approve poisoned page versions.

Affected Products

Concrete CMS 9.2.0
Concrete CMS versions 9.2.x through 9.5.2
Fixed in Concrete CMS 9.5.3

Discovery Timeline

2026-09-14 - CVE-2026-81901 published to NVD
2026-09-18 - Last updated in NVD database

Credit: Yonatan Drori from Tenzai reported the vulnerability to the Concrete CMS security team.

Technical Details for CVE-2026-81901

Vulnerability Analysis

The vulnerability resides in the REST API page update handler at PUT /ccm/api/1.0/pages/{cID}. The endpoint accepts fields that map to page properties, page templates, page types, and page attributes. The handler validates that the caller can edit page content but does not separately validate the caller's authorization to modify these higher-privilege fields.

Concrete CMS enforces distinct permission checks for page properties, templates, and types in its web UI. The REST API path bypasses these checks entirely. A user with only content-editing rights on a target page can therefore mutate configuration reserved for site administrators.

The most severe exploitation path abuses the header_extra_content attribute. Concrete CMS renders this attribute directly into the <head> element of every rendered page without HTML encoding. An attacker who writes JavaScript into header_extra_content achieves persistent stored XSS that runs in every visitor's browser session.

Root Cause

The root cause is missing authorization [CWE-862] on privileged fields exposed through the REST API endpoint. The handler conflates content-editing permission with the broader property, template, and type-editing permissions enforced elsewhere in the application. Compounding this, the header_extra_content attribute is treated as trusted HTML and injected verbatim into the response, providing a stored XSS sink for any user who reaches the endpoint.

Attack Vector

Exploitation requires network access to the REST API and valid credentials for an account with content-editing rights on at least one page. The attacker sends a PUT request to /ccm/api/1.0/pages/{cID} with a payload that sets header_extra_content to a JavaScript payload. When a reviewer with higher privileges loads the page to approve the version, the injected script executes with the reviewer's session context. This enables session theft, forced administrative actions, or account takeover through XSS-driven privilege escalation. See the ConcreteCMS 9.5.3 Release Notes for vendor details.

Detection Methods for CVE-2026-81901

Indicators of Compromise

Unexpected PUT requests to /ccm/api/1.0/pages/{cID} originating from non-administrative accounts.
Page audit records showing modifications to header_extra_content, page template, or page type by users without those UI permissions.
Rendered page HTML containing unfamiliar <script> tags, external script src references, or inline event handlers inside the <head> element.
Version approval events immediately preceded by property changes from a lower-privileged editor.

Detection Strategies

Enable REST API access logging and alert on PUT /ccm/api/1.0/pages/* requests from user accounts that lack administrative roles.
Diff rendered <head> content across page versions to identify newly inserted scripts or attribute-based JavaScript.
Correlate page-version approval events with the user who authored the version to spot privilege boundary crossings.

Monitoring Recommendations

Ship Concrete CMS application and web server logs to a centralized analytics platform for retention and correlation.
Monitor outbound requests from reviewer browsers to unrecognized domains that may indicate exfiltration by injected scripts.
Baseline the set of accounts that modify page attributes and alert on deviations.

How to Mitigate CVE-2026-81901

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which enforces authorization checks on the REST API page update endpoint.
Audit the header_extra_content attribute on every page for unauthorized JavaScript and remove any injected payloads.
Review REST API and page-version history since 2026-01-01 for suspicious PUT requests from non-administrative accounts.
Rotate session tokens and administrative credentials if evidence of exploitation is found.

Patch Information

Concrete CMS 9.5.3 addresses the missing authorization by enforcing page-property, page-template, and page-type permission checks on the PUT /ccm/api/1.0/pages/{cID} endpoint. Refer to the ConcreteCMS 9.5.3 Release Notes for the full patch summary and upgrade procedure.

Workarounds

Restrict access to /ccm/api/1.0/pages/* at the reverse proxy or web application firewall (WAF) layer to administrative IP ranges until the patch is applied.
Disable the REST API entirely if it is not in production use.
Remove content-editing rights from untrusted user accounts to shrink the exploitable population.
Configure a Content Security Policy (CSP) that blocks inline scripts to reduce the impact of stored XSS in the <head> element.

bash

# Example nginx block restricting the vulnerable endpoint to trusted IPs
location ~ ^/ccm/api/1\.0/pages/ {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://concrete_backend;
}