Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current version; blocks not aliased to another page or scrapbook entry were also removed from the global Blocks table and their block-type data table, permanently destroying the content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH: CVE-2026-81902 (CVSS 8.1) - CSRF flaw in Concrete CMS 9.0-9.5.2 allows remote attackers to delete page blocks via authenticated users. Patch immediately to v9.5.3+. #CVE #Vulnerability #PatchNow https://t.co/sJbgponPVE
Post summary
Tweet announces CVE-2026-81902 (CSRF in Concrete CMS, CVSS 8.1) with technical details and an explicit call to patch to v9.5.3+. No PoC, exploit tool, or active exploitation evidence is mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | concretecms | concrete_cms | - | - | - |