CVE-2026-81919: Concrete CMS CSRF Vulnerability

CVE-2026-81919 Overview

CVE-2026-81919 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Concrete CMS versions below 9.5.3. The arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks enforced page-edit authorization but omitted anti-CSRF token validation. The route also accepted any HTTP method. An attacker can lure a signed-in content editor to a malicious page that auto-submits a forged request, reordering or moving blocks in draft pages the victim can edit. The default null SameSite cookie configuration allows the victim's session cookie to accompany the forged request.

Critical Impact
Authenticated content editors visiting an attacker-controlled page can have block layouts silently modified on draft pages they are authorized to edit.

Affected Products

Concrete CMS versions below 9.5.3
Concrete\Controller\Backend\Page\ArrangeBlocks controller
Deployments using the default null SameSite cookie configuration

Discovery Timeline

Vulnerability reported by Yonatan Drori from Tenzai
2026-09-15 - CVE-2026-81919 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81919

Vulnerability Analysis

The flaw resides in the block-arrangement backend endpoint used by Concrete CMS editors. The arrange() action in Concrete\Controller\Backend\Page\ArrangeBlocks checks whether the caller is authorized to edit a page but never validates an anti-CSRF token on the incoming request. Combined with a permissive route that accepts any HTTP method, the endpoint is directly reachable by cross-origin form submissions and image or fetch requests.

The impact is limited to integrity of block ordering within draft page versions the victim already has permission to edit. Confidentiality and availability are not affected, and no data leaves the system. The scope is bounded because the attacker cannot elevate privileges or reach pages outside the victim's authorization scope.

Root Cause

The controller relies solely on the authorization check for page editing and does not call the framework's token validation helper. Because Concrete CMS ships with a null SameSite cookie attribute by default, browsers attach the victim's session cookie to cross-site POST or GET requests, letting the forged request authenticate as the editor.

Attack Vector

Exploitation requires a signed-in editor to load attacker-controlled content in the same browser session. The malicious page auto-submits a request to the vulnerable arrange endpoint, targeting a page ID the victim can edit. The server processes the reorder or move action against the draft version. No credentials, tokens, or interactive input beyond page navigation are required from the victim.

Refer to the ConcreteCMS Version 9.5 Release Notes for the vendor's technical description of the fix.

Detection Methods for CVE-2026-81919

Indicators of Compromise

Unexpected changes to block ordering or placement within draft page versions of the CMS.
Editor-attributed edits to ArrangeBlocks occurring shortly after the user browsed external content.
Requests to the arrange action with Referer or Origin headers pointing to unrelated third-party domains.

Detection Strategies

Inspect web server access logs for requests to the block-arrangement endpoint from cross-origin referrers.
Correlate audit-log block reorder events with the same user's outbound web activity to identify suspicious sequences.
Alert on any request to the endpoint using methods other than the expected POST from the CMS UI.

Monitoring Recommendations

Enable and centralize Concrete CMS audit logs for block and page version changes.
Monitor authentication session activity for editor accounts and flag anomalies in edit velocity.
Add web application firewall (WAF) rules that require a valid CSRF token on backend page endpoints.

How to Mitigate CVE-2026-81919

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later on all instances.
Configure the session cookie SameSite attribute to Lax or Strict to prevent cross-site cookie transmission.
Review recent block-arrangement changes on draft pages and revert unauthorized modifications.

Patch Information

Concrete CMS 9.5.3 adds anti-CSRF token validation to the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks. See the ConcreteCMS Version 9.5.3 Release Notes for the full changelog.

Workarounds

Restrict backend page endpoints to trusted network segments or via VPN until the patch is applied.
Deploy a WAF rule that rejects requests to /ccm/system/page/arrange_block lacking a valid CSRF token or same-origin Referer.
Instruct editors to sign out of the CMS when not actively editing to shrink the exposure window.

bash

# Example: enforce SameSite=Lax on Concrete CMS session cookies
# Add to application/config/concrete.php
'session' => [
    'cookie' => [
        'cookie_samesite' => 'Lax',
        'cookie_secure'   => true,
        'cookie_httponly' => true,
    ],
],