CVE-2026-81901

🗓️ 14 Sep 2026 20:38:54Reported by ConcreteCMSType

cve🔗 web.nvd.nist.gov👁 25 Views🌐 WEB

Stored XSS in Concrete CMS 9.2.0-9.5.2 via unauthorized page property update in REST API.

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint	14 Sep 202620:38	–	cvelist
EUVD	EUVD-2026-78089	14 Sep 202620:38	–	euvd
Mend	CVE-2026-81901	14 Sep 202620:38	–	mend
NVD	CVE-2026-81901	14 Sep 202621:17	–	nvd
Positive Technologies	PT-2026-91563	14 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-81901: Missing Authorization	14 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint	14 Sep 202620:38	–	vulnrichment

NVD

Node

concretecms concrete_cmsRange9.2.0–9.5.3

[
  {
    "vendor": "Concrete CMS",
    "product": "Concrete CMS",
    "collectionURL": "https://github.com/concretecms/concretecms",
    "repo": "https://github.com/concretecms/concretecms",
    "versions": [
      {
        "status": "affected",
        "version": "9.2.0",
        "lessThanOrEqual": "9.5.2",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
documentation	www.documentation.concretecms.org/developers/introduction/version-history/953-release-notes

Parameter	Position	Path	Description	CWE
cID	path	/ccm/api/1.0/pages/{cID}	The REST API page update endpoint fails to enforce authorization on page-property, page-template, or page-type. An attacker can modify the header_extra_content attribute to inject persistent JavaScript.	CWE-862

18 Sep 2026 19:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.7

CVSS 47.2

EPSS0.00383

SSVC

CWE-862