https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-85387.htmlhttps://patchthecve.com/cve/CVE-2026-85387.htmlMon, 21 Sep 2026 17:51:12 +0000HIGH 7.1: Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revohttps://patchthecve.com/cve/CVE-2026-18120.htmlhttps://patchthecve.com/cve/CVE-2026-18120.htmlMon, 21 Sep 2026 17:51:22 +0000MEDIUM 5.9: Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier chttps://patchthecve.com/cve/CVE-2026-87031.htmlhttps://patchthecve.com/cve/CVE-2026-87031.htmlMon, 21 Sep 2026 17:51:32 +0000LOW 2.7: n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) did not perform a permission check before creating an account. As a result, any valid OAuth token carrying the users:add scope, including a clihttps://patchthecve.com/cve/CVE-2026-87028.htmlhttps://patchthecve.com/cve/CVE-2026-87028.htmlMon, 21 Sep 2026 17:51:39 +0000MEDIUM 6.5: Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an authhttps://patchthecve.com/cve/CVE-2026-85386.htmlhttps://patchthecve.com/cve/CVE-2026-85386.htmlMon, 21 Sep 2026 17:51:55 +0000MEDIUM 6.1: Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the application's own origin. An unauthenticated vhttps://patchthecve.com/cve/CVE-2026-85385.htmlhttps://patchthecve.com/cve/CVE-2026-85385.htmlMon, 21 Sep 2026 17:52:41 +0000CRITICAL 9.6: Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName() returns any non-IANA value unchanged. A stored cross-site scripting payload saved in this field ehttps://patchthecve.com/cve/CVE-2026-81927.htmlhttps://patchthecve.com/cve/CVE-2026-81927.htmlFri, 18 Sep 2026 15:15:46 +0000MEDIUM 5.4: Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode (concrete.file_manager.images.svg_sanitization.action = reject), uploaded SVGs were checkedhttps://patchthecve.com/cve/CVE-2026-81926.htmlhttps://patchthecve.com/cve/CVE-2026-81926.htmlMon, 21 Sep 2026 17:53:00 +0000MEDIUM 6.1: Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the dialohttps://patchthecve.com/cve/CVE-2026-18426.htmlhttps://patchthecve.com/cve/CVE-2026-18426.htmlMon, 21 Sep 2026 17:53:06 +0000MEDIUM 6.5: Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an authenticatehttps://patchthecve.com/cve/CVE-2026-81925.htmlhttps://patchthecve.com/cve/CVE-2026-81925.htmlMon, 21 Sep 2026 17:53:13 +0000MEDIUM 6.1: Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to thehttps://patchthecve.com/cve/CVE-2026-18425.htmlhttps://patchthecve.com/cve/CVE-2026-18425.htmlMon, 21 Sep 2026 17:51:00 +0000LOW 2.7: Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated uhttps://patchthecve.com/cve/CVE-2026-18424.htmlhttps://patchthecve.com/cve/CVE-2026-18424.htmlMon, 21 Sep 2026 17:50:50 +0000HIGH 7.1: Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first `ValidatedRemoteUrl` is retained and reused for every later URL with that host. A low-privilehttps://patchthecve.com/cve/CVE-2026-18423.htmlhttps://patchthecve.com/cve/CVE-2026-18423.htmlMon, 21 Sep 2026 17:50:42 +0000HIGH 7.1: Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved searhttps://patchthecve.com/cve/CVE-2026-18422.htmlhttps://patchthecve.com/cve/CVE-2026-18422.htmlMon, 21 Sep 2026 17:50:08 +0000MEDIUM 6.5: Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Page\Multilingual::assign). As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a shttps://patchthecve.com/cve/CVE-2026-81924.htmlhttps://patchthecve.com/cve/CVE-2026-81924.htmlMon, 21 Sep 2026 17:50:00 +0000MEDIUM 6.5: Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controller's activate_files() action created PageTemplate records from attacker-supplied pageTemplates[] values without validating an anti-CSRF tokehttps://patchthecve.com/cve/CVE-2026-81923.htmlhttps://patchthecve.com/cve/CVE-2026-81923.htmlFri, 18 Sep 2026 15:28:11 +0000LOW 2.7: In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user who was granted access to the bulk SEO tool and https://patchthecve.com/cve/CVE-2026-81922.htmlhttps://patchthecve.com/cve/CVE-2026-81922.htmlFri, 18 Sep 2026 15:28:38 +0000LOW 2.7: Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_top and send_to_bottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the athttps://patchthecve.com/cve/CVE-2026-81921.htmlhttps://patchthecve.com/cve/CVE-2026-81921.htmlFri, 18 Sep 2026 15:29:38 +0000MEDIUM 5.4: Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could thereforhttps://patchthecve.com/cve/CVE-2026-81920.htmlhttps://patchthecve.com/cve/CVE-2026-81920.htmlFri, 18 Sep 2026 15:27:27 +0000MEDIUM 4.3: Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-configured reserved-word list (concrete.seo.exclude_words) but did not validate the anti-CSRF token that the reset modal emitted, anhttps://patchthecve.com/cve/CVE-2026-81919.htmlhttps://patchthecve.com/cve/CVE-2026-81919.htmlFri, 18 Sep 2026 15:26:37 +0000MEDIUM 4.3: Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an atthttps://patchthecve.com/cve/CVE-2026-81897.htmlhttps://patchthecve.com/cve/CVE-2026-81897.htmlTue, 22 Sep 2026 19:16:52 +0000MEDIUM 5.4: In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker without credentials could write attacker-controlled heahttps://patchthecve.com/cve/CVE-2026-81896.htmlhttps://patchthecve.com/cve/CVE-2026-81896.htmlTue, 22 Sep 2026 19:16:52 +0000MEDIUM 5.4: Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report (concrete/single_pages/dashboard/reports/forms/legacy.php). a rogue editor could store markup or script in a label thttps://patchthecve.com/cve/CVE-2026-81895.htmlhttps://patchthecve.com/cve/CVE-2026-81895.htmlTue, 22 Sep 2026 19:16:52 +0000HIGH 7.2: In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of chttps://patchthecve.com/cve/CVE-2026-81894.htmlhttps://patchthecve.com/cve/CVE-2026-81894.htmlTue, 22 Sep 2026 19:16:52 +0000MEDIUM 5.4: Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js) re-parses the attribute-decoded caption as HTML through jQuery's .aphttps://patchthecve.com/cve/CVE-2026-18111.htmlhttps://patchthecve.com/cve/CVE-2026-18111.htmlThu, 15 Oct 2026 19:27:30 +0000MEDIUM 6.1: Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withouthttps://patchthecve.com/cve/CVE-2026-18110.htmlhttps://patchthecve.com/cve/CVE-2026-18110.htmlTue, 22 Sep 2026 18:17:11 +0000HIGH 7.5: Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to https://patchthecve.com/cve/CVE-2026-81900.htmlhttps://patchthecve.com/cve/CVE-2026-81900.htmlWed, 16 Sep 2026 20:47:10 +0000MEDIUM 6.1: Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executehttps://patchthecve.com/cve/CVE-2026-18116.htmlhttps://patchthecve.com/cve/CVE-2026-18116.htmlMon, 21 Sep 2026 17:49:50 +0000MEDIUM 6.1: Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval workhttps://patchthecve.com/cve/CVE-2026-18117.htmlhttps://patchthecve.com/cve/CVE-2026-18117.htmlTue, 29 Sep 2026 19:17:27 +0000MEDIUM 5.4: Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim() to the submitted value and performed no input neutralization. An authenticated user holding canWrite (editor) permission on a page could stohttps://patchthecve.com/cve/CVE-2026-81903.htmlhttps://patchthecve.com/cve/CVE-2026-81903.htmlFri, 18 Sep 2026 19:12:09 +0000MEDIUM 5.4: Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute outputhttps://patchthecve.com/cve/CVE-2026-81902.htmlhttps://patchthecve.com/cve/CVE-2026-81902.htmlFri, 18 Sep 2026 19:13:05 +0000HIGH 8.1: Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current vershttps://patchthecve.com/cve/CVE-2026-81901.htmlhttps://patchthecve.com/cve/CVE-2026-81901.htmlFri, 18 Sep 2026 19:17:29 +0000HIGH 8.7: In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the APhttps://patchthecve.com/cve/CVE-2026-18119.htmlhttps://patchthecve.com/cve/CVE-2026-18119.htmlFri, 18 Sep 2026 19:23:08 +0000CRITICAL 9.0: Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session and escalate privileges. The Concrete CMS securithttps://patchthecve.com/cve/CVE-2026-81918.htmlhttps://patchthecve.com/cve/CVE-2026-81918.htmlFri, 18 Sep 2026 15:05:21 +0000MEDIUM 4.8: Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type athttps://patchthecve.com/cve/CVE-2026-81917.htmlhttps://patchthecve.com/cve/CVE-2026-81917.htmlFri, 18 Sep 2026 15:18:54 +0000MEDIUM 5.4: Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block wihttps://patchthecve.com/cve/CVE-2026-81907.htmlhttps://patchthecve.com/cve/CVE-2026-81907.htmlThu, 24 Sep 2026 20:02:32 +0000HIGH 7.1: Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforce a failed CSRF token check, allowing the destructive operationhttps://patchthecve.com/cve/CVE-2026-68535.htmlhttps://patchthecve.com/cve/CVE-2026-68535.htmlThu, 24 Sep 2026 20:05:45 +0000MEDIUM 4.3: Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the referenced file is authorized against the user's file-manager visibhttps://patchthecve.com/cve/CVE-2026-81916.htmlhttps://patchthecve.com/cve/CVE-2026-81916.htmlFri, 18 Sep 2026 15:23:18 +0000MEDIUM 4.3: Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Express ohttps://patchthecve.com/cve/CVE-2026-81915.htmlhttps://patchthecve.com/cve/CVE-2026-81915.htmlThu, 24 Sep 2026 20:07:18 +0000MEDIUM 5.3: Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), so a signed-in dashboard user permitted to edit onhttps://patchthecve.com/cve/CVE-2026-81913.htmlhttps://patchthecve.com/cve/CVE-2026-81913.htmlThu, 24 Sep 2026 20:13:27 +0000MEDIUM 6.1: Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handlhttps://patchthecve.com/cve/CVE-2026-81912.htmlhttps://patchthecve.com/cve/CVE-2026-81912.htmlThu, 24 Sep 2026 20:18:47 +0000MEDIUM 5.7: Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenthttps://patchthecve.com/cve/CVE-2026-81911.htmlhttps://patchthecve.com/cve/CVE-2026-81911.htmlFri, 18 Sep 2026 19:00:06 +0000MEDIUM 5.4: Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request only against the target board instance (canEditBoardContents()) and then persists the client-supplied selectedTemplateOption[collection] verbatihttps://patchthecve.com/cve/CVE-2026-68526.htmlhttps://patchthecve.com/cve/CVE-2026-68526.htmlFri, 25 Sep 2026 20:41:17 +0000MEDIUM 4.3: Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission, https://patchthecve.com/cve/CVE-2026-81910.htmlhttps://patchthecve.com/cve/CVE-2026-81910.htmlWed, 16 Sep 2026 17:40:45 +0000MEDIUM 6.5: Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageSt