CVE-2026-81919

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit authorization but performed no CSRF token check , and its route accepted an...