CVE-2026-81902

Concrete CMS versions 9.0.0 through 9.5.2 contain a CSRF vulnerability in the orphaned block removal panel action (removeOrphanedBlocks) due to a missing CSRF token validation. A remote attacker can craft a request that, when loaded by an authenticated user with edit permission on the target page...

CVE-2026-81902 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup

Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...