CVE-2026-81901

Concrete CMS versions 9.2.0 through 9.5.2 are affected by a stored cross-site scripting (XSS) vulnerability in the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID} ). The endpoint did not enforce page-property, page-template, or page-type authorization, allowing a user with only conten...