CVE-2026-81907: Concrete CMS CSRF Vulnerability

CVE-2026-81907 Overview

CVE-2026-81907 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Concrete CMS 9.5.2 and earlier. The flaw resides in the Express Clear Entries function reachable at POST /index.php/dashboard/system/express/entities/delete_entries. The controller records a failed CSRF token check but does not enforce it, permitting the destructive operation to complete when the token is missing or invalid. A remote unauthenticated attacker can trick an authenticated administrator into visiting a malicious page that permanently deletes all entries belonging to an attacker-selected Express entity. The default Contact Express object ships with a fixed entity UUID, so the target identifier is discoverable without dashboard access.

Critical Impact
A single administrator visit to an attacker-controlled page can permanently destroy all records within a targeted Express entity, including the default Contact form data.

Affected Products

Concrete CMS 9.0.0 through 9.5.2
Concrete CMS default Contact Express object (fixed UUID)
Concrete CMS Express entity management dashboard

Discovery Timeline

Vulnerability reported by Pratik Zanjurne to the Concrete CMS security team
2026-09-11 - CVE-2026-81907 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-81907

Vulnerability Analysis

The vulnerability affects the Express entity management subsystem in Concrete CMS. Express is the framework's data modeling feature used to create custom entity types such as contact forms and address books. The delete_entries endpoint permanently removes all records belonging to a specified entity.

The controller behind POST /index.php/dashboard/system/express/entities/delete_entries performs a CSRF token validation step and logs the outcome. The result of that validation is not used to interrupt execution. Requests without a valid token continue through to the destructive database operation. This creates an exploitable state-changing endpoint that can be triggered by any cross-origin request from an authenticated administrator's browser.

Because the default Contact Express object uses a fixed, well-known entity UUID, the attacker does not need prior reconnaissance or dashboard visibility to select a target. Any Concrete CMS installation running an unpatched version and using the shipped Contact form is exposed to data loss.

Root Cause

The root cause is a broken authorization check pattern in the delete_entries controller. The code records the CSRF verification result but omits the enforcement branch that should short-circuit execution on failure. This maps to CWE-352, Cross-Site Request Forgery, and reflects an implementation error rather than an absence of CSRF infrastructure.

Attack Vector

Exploitation requires an authenticated Concrete CMS administrator to visit an attacker-controlled page while their dashboard session is active. The malicious page issues a cross-origin POST request to the vulnerable endpoint with the target entity UUID as a parameter. The administrator's browser attaches the session cookie, the server accepts the request despite the invalid token, and the targeted Express entity's entries are permanently deleted. No user privileges are required on the attacker side, and interaction is limited to a single click or page load by the victim.

No verified public exploit code is available at the time of publication. Technical details are documented in the Concrete CMS 9.5.3 Release Notes.

Detection Methods for CVE-2026-81907

Indicators of Compromise

Unexpected POST requests to /index.php/dashboard/system/express/entities/delete_entries in web server access logs
Application logs recording CSRF token validation failures immediately followed by successful entity deletion events
Sudden emptying of Express entity tables, particularly the default Contact form, without corresponding administrator activity
HTTP Referer headers pointing to external or untrusted origins on requests to the Express delete endpoint

Detection Strategies

Alert on any request to the delete_entries endpoint whose Referer or Origin header does not match the site's own domain
Correlate CSRF token failure log entries with subsequent database DELETE operations against Express entity tables
Baseline normal administrator behavior for bulk-delete actions and flag deviations in frequency or timing

Monitoring Recommendations

Forward Concrete CMS application logs and web server access logs to a centralized log platform for retention and correlation
Monitor administrator session activity for cross-origin state-changing requests during active dashboard sessions
Track row counts on Express entity tables and alert on large-percentage drops between snapshots

How to Mitigate CVE-2026-81907

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, where the CSRF enforcement gap in delete_entries is fixed
Audit Express entity tables for unexpected data loss and restore from backups if entries are missing
Require administrators to log out of the dashboard when not actively using it to reduce session exposure

Patch Information

Concrete CMS resolved this vulnerability in version 9.5.3. The fix enforces the CSRF token check in the Express delete_entries controller so requests with missing or invalid tokens are rejected. Refer to the Concrete CMS 9.5.3 Release Notes for the full change list and upgrade guidance.

Workarounds

Restrict access to /index.php/dashboard/system/express/ at the web server or reverse proxy level to trusted administrative IP ranges
Deploy a web application firewall rule that blocks POST requests to delete_entries when the Origin or Referer header is absent or does not match the site's domain
Instruct administrators to use a dedicated browser or profile for dashboard access, isolating the authenticated session from general web browsing

bash

# Example nginx rule to block cross-origin POSTs to the vulnerable endpoint
location = /index.php/dashboard/system/express/entities/delete_entries {
    if ($request_method = POST) {
        if ($http_origin !~* ^https?://(www\.)?example\.com$) {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}