CVE-2026-81920: Concrete CMS CSRF Vulnerability

CVE-2026-81920 Overview

CVE-2026-81920 is a Cross-Site Request Forgery (CSRF) vulnerability in Concrete CMS versions below 9.5.3. The flaw resides in the dashboard SEO Excluded Words page, specifically in the reset() controller action. This action clears the administrator-configured reserved-word list stored in concrete.seo.exclude_words but fails to validate the anti-CSRF token that the reset modal emits. The action also does not restrict requests to the POST method. A remote attacker can lure an authenticated user with SEO access to a crafted page and silently revert the reserved-word list to its default. This vulnerability is classified under CWE-352.

Critical Impact
Successful exploitation reverts the SEO excluded-words list to defaults, silently altering URL-slug generation for pages, files, topics, and other objects created through the Text urlify service.

Affected Products

Concrete CMS versions prior to 9.5.3
Dashboard SEO Excluded Words functionality
Objects generated through the Text urlify service (pages, files, topics)

Discovery Timeline

2026-09-15 - CVE-2026-81920 published to NVD
2026-09-16 - Last updated in NVD database
Vulnerability reported by riodrwn to the Concrete CMS security team

Technical Details for CVE-2026-81920

Vulnerability Analysis

The vulnerability exists in the Concrete CMS dashboard controller responsible for managing SEO excluded words. The reset() action is intended to restore the reserved-word configuration concrete.seo.exclude_words to its default state. Two defects combine to produce the CSRF condition. First, the action does not verify the anti-CSRF token that the reset modal emits in the dashboard UI. Second, the action accepts requests through HTTP methods other than POST, including GET. These weaknesses allow an off-site attacker to craft a request that a logged-in user's browser will execute automatically.

The impact is limited to integrity of SEO configuration. Confidentiality and availability are not affected. However, the change silently alters URL-slug generation policy for future content, undoing the site's configured SEO strategy without visible warning.

Root Cause

The root cause is missing CSRF token validation combined with permissive HTTP method handling in the reset() controller action. State-changing actions must both enforce POST semantics and validate a per-session anti-CSRF token. The reset action does neither, despite the reset modal in the dashboard emitting a token intended for validation.

Attack Vector

Exploitation requires an authenticated user who holds SEO dashboard access to visit an attacker-controlled page while their Concrete CMS session is active. The malicious page issues a cross-origin request (via an image tag, form auto-submit, or fetch call) to the vulnerable reset() endpoint. Because no token is checked and GET is accepted, the request completes with the victim's session cookies. The excluded-words list is cleared and reverts to defaults. See the Concrete CMS 9.5.3 Release Notes for the vendor patch discussion.

Detection Methods for CVE-2026-81920

Indicators of Compromise

Unexpected changes to the concrete.seo.exclude_words configuration reverting to default values
URL slugs for newly created pages, files, or topics deviating from the administrator-defined SEO policy
HTTP requests to the SEO Excluded Words reset() endpoint originating from unusual referrers or with GET method

Detection Strategies

Audit application and web server logs for requests to the dashboard SEO Excluded Words reset endpoint that lack a same-origin Referer or Origin header
Monitor Concrete CMS configuration change events for concrete.seo.exclude_words modifications outside of scheduled administrative activity
Correlate slug-generation anomalies in new content against timestamps of suspicious reset requests

Monitoring Recommendations

Enable verbose audit logging on the Concrete CMS dashboard and forward events to a centralized SIEM for retention and correlation
Alert on HTTP GET requests to state-changing dashboard endpoints, which should always be POST
Track SEO configuration file diffs through file integrity monitoring on the Concrete CMS installation directory

How to Mitigate CVE-2026-81920

Immediate Actions Required

Upgrade all Concrete CMS instances to version 9.5.3 or later where the reset() action enforces CSRF token validation and POST-only semantics
Review the current concrete.seo.exclude_words list against the documented site policy and restore any missing entries
Restrict SEO dashboard access to accounts that require it and rotate sessions for users who may have been targeted

Patch Information

Concrete CMS addressed this issue in version 9.5.3. Details of the fix are documented in the Concrete CMS 9.5.3 Release Notes. The patch adds anti-CSRF token validation to the reset controller action and restricts the endpoint to POST requests.

Workarounds

Limit SEO dashboard permissions to a minimal set of trusted administrators until the upgrade is applied
Deploy a web application firewall rule that blocks GET requests to the dashboard SEO Excluded Words reset endpoint
Instruct administrators with SEO access to use isolated browser sessions when working in the Concrete CMS dashboard

bash

# Example WAF rule concept: block non-POST requests to the reset endpoint
# (adapt path and syntax to your WAF; verify against your Concrete CMS routing)
SecRule REQUEST_METHOD "!@streq POST" \
  "id:1029201,\
   phase:1,\
   deny,\
   status:405,\
   msg:'Block non-POST to SEO excluded words reset (CVE-2026-81920)',\
   chain"
  SecRule REQUEST_URI "@contains /dashboard/system/seo/excluded_words/reset"