CVE-2026-81911 Overview
CVE-2026-81911 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions 9.0.0 through 9.5.2. The flaw resides in the Board Custom Slot dialog, specifically the custom_slotsave_template endpoint. An authenticated user with permission to edit at least one board instance can persist a forged summary object containing a JavaScript payload in the description field. The default summary template renders this field without output encoding, executing the payload for any user who views the affected board slot. Concrete CMS versions below 9 do not include the Boards feature and are unaffected.
Critical Impact
An attacker with board-edit privileges can store JavaScript that executes in the browsers of anonymous front-end visitors and administrators, enabling session hijacking, action takeover, and privilege escalation.
Affected Products
- Concrete CMS 9.0.0 through 9.5.2
- Concrete CMS deployments using the Boards feature
- Sites permitting multiple users to edit board contents
Discovery Timeline
- 2026-09-11 - CVE-2026-81911 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-81911
Vulnerability Analysis
The vulnerability stems from insufficient server-side validation in the custom_slotsave_template endpoint. The endpoint authorizes the request against the target board instance using canEditBoardContents() but then persists the client-supplied selectedTemplateOption[collection] verbatim. The server does not rebuild the content object collection or verify that each item belongs to the authorized board's data pool.
This design flaw allows an authenticated user with edit rights on any single board instance to inject a crafted summary object. The forged object carries a description field containing HTML with embedded JavaScript. Because the default summary template renders description without output encoding, the payload executes in every viewer's browser context. Affected viewers include unauthenticated front-end visitors and dashboard users previewing the resulting rule or block. The issue is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Root Cause
Two compounding defects produce the vulnerability. First, the save_template endpoint trusts client-supplied collection data without re-validating item ownership against the authorized board's data pool. Second, the summary template renders the persisted description field as raw HTML rather than encoding it for safe output.
Attack Vector
An authenticated attacker with canEditBoardContents() permission on one board instance sends a crafted request to the custom_slotsave_template endpoint. The request includes a selectedTemplateOption[collection] payload whose description field contains malicious HTML and JavaScript. The server persists the payload without sanitization. When any user renders the affected board slot, the injected script executes, allowing the attacker to steal session cookies, perform actions on behalf of the victim, or escalate toward administrator control.
No verified public proof-of-concept code is available. See the ConcreteCMS Version 9.5 Release Notes for vendor technical details.
Detection Methods for CVE-2026-81911
Indicators of Compromise
- Unexpected <script> tags, event handlers, or javascript: URIs stored within board slot description fields in the Concrete CMS database.
- POST requests to the custom_slotsave_template endpoint containing HTML-bearing selectedTemplateOption[collection] parameters.
- Unusual outbound requests from browsers viewing board pages, indicating exfiltration of session tokens or CSRF tokens.
Detection Strategies
- Audit stored board slot records for HTML tags, encoded script markers, or non-printable characters within description fields.
- Review web server access logs for authenticated POST requests to board custom slot template endpoints originating from low-privilege accounts.
- Correlate administrative account activity with prior board slot views to identify potential session takeover events.
Monitoring Recommendations
- Enable verbose logging on board editing endpoints and forward events to a centralized SIEM for retention and analysis.
- Monitor for anomalous behavior in dashboard user sessions such as unexpected privilege changes or new administrator accounts.
- Deploy a web application firewall rule set that flags HTML or JavaScript payloads submitted to save_template endpoints.
How to Mitigate CVE-2026-81911
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which addresses CVE-2026-81911.
- Inventory all users with canEditBoardContents() permission and revoke access from accounts that do not require it.
- Audit existing board slots for previously injected payloads and remove any that contain unsanitized HTML.
Patch Information
Concrete CMS resolved this vulnerability in the 9.5.3 release. Refer to the ConcreteCMS Version 9.5 Release Notes for upgrade guidance and the full changelog. The vendor credits riodrwn for reporting the issue.
Workarounds
- Restrict board editing permissions to a minimal set of trusted users until the patch is applied.
- Disable public rendering of board slots on front-end pages if the Boards feature is not business-critical.
- Deploy a Content Security Policy (CSP) that blocks inline script execution to reduce the impact of stored XSS payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
