CVE-2026-81912: Concrete CMS CSRF Vulnerability

CVE-2026-81912 Overview

CVE-2026-81912 is a Cross-Site Request Forgery (CSRF) vulnerability in Concrete CMS versions prior to 9.5.3. The flaw resides in the Move Multiple Groups feature exposed through the dashboard/users/groups/bulkupdate/confirm() endpoint. The endpoint moves selected group tree nodes without validating an anti-CSRF action token. An attacker can craft a malicious request that, when triggered by an authenticated privileged user, relocates groups under a new parent. Because group members inherit permissions from the parent group, a forged move can alter effective authorization across the CMS.

Critical Impact
A successful CSRF attack can escalate or modify user permissions by relocating groups within the hierarchy, changing which access rights members inherit.

Affected Products

Concrete CMS versions prior to 9.5.3
Concrete CMS dashboard component (dashboard/users/groups/bulkupdate)
Deployments where privileged administrators access external content while authenticated

Discovery Timeline

2026-09-11 - CVE-2026-81912 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database
Vulnerability reported to Concrete CMS by the researcher credited as riodrwn

Technical Details for CVE-2026-81912

Vulnerability Analysis

The vulnerability is classified under [CWE-352] Cross-Site Request Forgery. Concrete CMS exposes a bulk group management workflow through dashboard/users/groups/bulkupdate/confirm(). This endpoint accepts a state-changing request to move multiple group tree nodes to a new parent. The handler processes the move without verifying that the request carries a valid, per-session action token bound to the authenticated user.

An attacker who convinces an authenticated administrator to visit a hostile page can trigger the group move using the victim's session cookies. The effect is not limited to reorganization. In Concrete CMS, a group inherits the permissions of its parent, and members inherit those group permissions transitively. Moving a group under a different parent therefore changes the effective authorization of every user in the moved group.

Root Cause

The root cause is the absence of action token validation on a state-changing HTTP request. The bulkupdate/confirm() route trusts the session cookie for authentication but does not require a synchronizer token or equivalent origin-bound proof that the authenticated user intended the action.

Attack Vector

Exploitation requires an attacker-controlled page and user interaction from a high-privilege authenticated victim. The attacker hosts a page that auto-submits a crafted form or issues a fetch request against the vulnerable endpoint with predictable parameters identifying source groups and a target parent group. When the administrator loads the page, the browser attaches the Concrete CMS session cookie, and the server processes the group relocation. No credentials are stolen and no code is executed on the server. The impact is confined to authorization changes driven by the altered group hierarchy.

No public proof-of-concept exploit is currently available. Refer to the Concrete CMS 9.5.3 Release Notes for vendor details.

Detection Methods for CVE-2026-81912

Indicators of Compromise

Unexpected POST requests to dashboard/users/groups/bulkupdate/confirm with a Referer or Origin header pointing to an external domain.
Audit log entries showing group moves that do not correspond to any administrator ticket or change record.
Unexplained permission inheritance changes for user groups, particularly groups gaining access to sensitive dashboard areas.

Detection Strategies

Review web server access logs for requests to the bulk group update endpoint originating from unusual referrers or performed outside normal administrator working hours.
Correlate Concrete CMS audit logs of group hierarchy changes with authenticated administrator activity to identify moves lacking a legitimate UI workflow.
Alert on any HTTP POST to /dashboard/users/groups/bulkupdate/* where the request lacks the expected CSRF token parameter in pre-patch traffic captures.

Monitoring Recommendations

Ingest Concrete CMS web and application logs into a centralized log platform and build queries for group tree modifications.
Monitor administrator browser sessions for concurrent access to third-party sites while an authenticated dashboard session is active.
Track privilege drift by periodically exporting the group hierarchy and diffing it against a known-good baseline.

How to Mitigate CVE-2026-81912

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later on all production and staging instances.
Audit the group hierarchy for unauthorized parent changes and revert any moves that cannot be attributed to a legitimate administrator action.
Restrict dashboard access to trusted networks or via VPN to reduce exposure of authenticated administrator sessions to hostile pages.

Patch Information

Concrete CMS addressed the issue in version 9.5.3 by adding action token validation to the Move Multiple Groups workflow. Full remediation details are documented in the Concrete CMS 9.5.3 Release Notes.

Workarounds

Instruct administrators to log out of the Concrete CMS dashboard when not actively performing management tasks.
Enforce the SameSite=Strict attribute on the Concrete CMS session cookie at the reverse proxy to limit cross-site cookie transmission.
Deploy a web application firewall rule that blocks POST requests to dashboard/users/groups/bulkupdate/confirm when the Origin header does not match the CMS hostname.

bash

# Example nginx rule to block cross-origin POSTs to the vulnerable endpoint
location ~ ^/dashboard/users/groups/bulkupdate/confirm {
    if ($http_origin !~* "^https?://cms\.example\.com$") {
        return 403;
    }
    proxy_pass http://concrete_backend;
}