CVE-2026-81902 Overview
CVE-2026-81902 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Concrete CMS versions 9 through 9.5.2. The removeOrphanedBlocks panel action fails to validate a CSRF token before executing content deletion. A remote attacker can craft a malicious request that, when loaded by an authenticated user with edit permission on the target page, deletes every block on that page's current version. Blocks that are not aliased to another page or scrapbook entry are also removed from the global Blocks table and their block-type data table, permanently destroying content.
Critical Impact
Authenticated editors visiting an attacker-controlled page can trigger irreversible destruction of page content, including removal from the global Blocks table and block-type data tables.
Affected Products
- Concrete CMS 9.0 through 9.5.2
- Component: concretecms:concrete_cms
- Affected endpoint: removeOrphanedBlocks panel action
Discovery Timeline
- Vulnerability reported by Yonatan Drori from Tenzai
- 2026-09-14 - CVE-2026-81902 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-81902
Vulnerability Analysis
The flaw resides in the panel action responsible for removing orphaned blocks from a page. Concrete CMS enforces CSRF protection on most state-changing endpoints through a validation token, but the removeOrphanedBlocks action omits this check. This allows an attacker to forge a request that a victim's browser will submit with the victim's authenticated session cookies.
Exploitation requires the victim to hold edit permission on the target page. When the forged request executes, the application iterates through blocks on the current page version and deletes them. For blocks lacking references elsewhere in the CMS (aliases on other pages or scrapbook entries), the destruction cascades into the global Blocks table and the corresponding block-type data table. The operation is irreversible without external backups.
Root Cause
The root cause is a missing anti-CSRF token verification on a privileged action handler. Concrete CMS relies on a per-session token to distinguish user-initiated requests from cross-origin forgeries, and the removeOrphanedBlocks handler was not wired into that validation path. The impact is scoped to integrity, with no confidentiality or availability effect on the underlying platform.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a page containing an auto-submitting form or image tag that issues the crafted request to the Concrete CMS removeOrphanedBlocks endpoint. The attacker then lures an authenticated editor to visit the page through phishing, forum posts, or embedded content. The victim's browser attaches the session cookie automatically, and the server executes the destructive action without further consent.
No verified proof-of-concept code is publicly available. See the ConcreteCMS Version 9.5.3 Release Notes for the vendor's remediation notes.
Detection Methods for CVE-2026-81902
Indicators of Compromise
- Unexplained deletion of blocks from page current versions in Concrete CMS site activity logs.
- HTTP requests to the removeOrphanedBlocks panel action with Referer or Origin headers pointing to untrusted external domains.
- Sudden reduction in row counts within the Blocks table or block-type data tables without a corresponding administrative action.
Detection Strategies
- Review web server access logs for POST requests to the removeOrphanedBlocks endpoint originating from off-site referrers.
- Correlate CMS audit logs of block deletions with authenticated user session activity to identify suspicious cross-origin patterns.
- Alert on bulk block deletions occurring within short time windows on a single page or across multiple pages by one user.
Monitoring Recommendations
- Enable and centralize Concrete CMS application logs, including edit and delete actions, for retention and analysis.
- Monitor database change volume on the Blocks table and block-type data tables to catch abnormal deletion spikes.
- Track outbound web traffic from editorial workstations to detect visits to unknown domains during CMS sessions.
How to Mitigate CVE-2026-81902
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which addresses the missing CSRF validation on removeOrphanedBlocks.
- Instruct users with edit permissions to avoid browsing untrusted sites while authenticated to the CMS.
- Verify recent database and file backups exist and are restorable before applying the patch.
Patch Information
Concrete CMS resolved the issue in the 9.5.3 release. Details are available in the ConcreteCMS Version 9.5.3 Release Notes. Administrators running versions 9.0 through 9.5.2 should plan an upgrade following the vendor's standard update process.
Workarounds
- Restrict page edit permissions to the minimum set of trusted users until the patch is applied.
- Deploy a web application firewall rule to block requests to the removeOrphanedBlocks endpoint that lack a same-origin Referer or Origin header.
- Enforce short session lifetimes and require re-authentication for editorial actions to reduce the exposure window for CSRF attacks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
