CVE-2026-81924

Executive Summary

CVE-2026-81924 is a Cross-Site Request Forgery (CSRF) vulnerability in Concrete CMS (formerly concrete5) before version 9.5.3, affecting the Dashboard theme Inspect controller's activate_files() action. A remote attacker can host a malicious page that auto-submits a forged POST request; if a signed-in administrator visits it, the request executes in the administrator's session and creates theme page-template records without consent. The impact is limited integrity modification of site configuration (CVSS v4.0 score 2.1), and no public PoC, exploit code, or KEV listing currently exists.

Technical Analysis

The vulnerability class is CWE-352 (Cross-Site Request Forgery). Per the NVD description, the affected component is the Dashboard theme Inspect controller, specifically the activate_files() action. That action created PageTemplate records from attacker-supplied pageTemplates[] values without validating an anti-CSRF token.

The core defect is the absence of state-changing request validation on an administrative endpoint. In Concrete CMS, dashboard actions are privileged operations reachable through the authenticated admin session. Because no token was required, the server accepted any authenticated POST to the action — including one originating from a third-party origin — and treated the pageTemplates[] input as authoritative.

Key mechanism points, strictly from the description:

• The action name is activate_files() on the theme Inspect controller.
• Input parameter: pageTemplates[] (array parameter).
• Effect: creation of PageTemplate records (theme page templates).
• Missing control: anti-CSRF token validation.

The CVSS v4.0 vector AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N indicates network vector, high attack complexity modifier reflected as AT:P (attack requirements: present), privileges required: high (administrator), no user interaction subscore (UI:N) as scored, and low integrity impact only (VI:L). Confidentiality and availability are unaffected, and no subsequent-system impact is scored.

No code-level details beyond the action name, parameter name, and resulting record type are available. Any further specifics (e.g., method signatures, route paths, template IDs) must not be assumed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the CSRF vulnerability class and the NVD description only.

1. Reconnaissance / target identification. The attacker fingerprints Concrete CMS installations below 9.5.3 (via public fingerprints such as the login/dashboard paths and CMS signatures). The target must have an authenticated administrator who can be induced to load an attacker-controlled page, and the theme Inspect feature must be reachable in that admin's session.

2. Triggering the CSRF flaw. The attacker constructs a hosted HTML page containing a form that auto-submits a POST request to the vulnerable activate_files() action on the target Concrete CMS instance. The form populates the pageTemplates[] parameter with attacker-chosen values. No anti-CSRF token is included or required because the action does not validate one.

3. Payload / execution at the vulnerability-class level. When a signed-in administrator visits the malicious page, the browser issues the forged POST using the administrator's existing session cookies. Concrete CMS processes the request as a legitimate admin action and creates PageTemplate records from the attacker-supplied pageTemplates[] values. Because this is a CSRF (session-riding) attack rather than injection, execution is confined to what the activate_files() action will accept as template input.

4. Post-exploitation impact. The site's theme page-template configuration is modified without the administrator's knowledge or consent. This is an integrity-only change to site configuration. There is no scored confidentiality or availability impact, and no evidence in the provided data of code execution, privilege escalation, or data exfiltration arising from this CVE.

Impact Assessment

The CVSS v4.0 base score is 2.1 (Low severity). Subscores:

• Exploitability modifiers: AV:N (network), AC:L (low complexity), AT:P (attack requirements present — an authenticated admin must be induced to load the page while logged in), PR:H (high privileges required, i.e., an authenticated administrator session), UI:N (no additional user interaction subscore).
• Vulnerable system impact: VC:N (no confidentiality), VI:L (low integrity), VA:N (no availability).
• Subsequent system impact: none (SC:N/SI:N/SA:N).

Business impact: unauthorized modification of theme page-template configuration, which could enable misleading or unauthorized site presentation and erode configuration integrity. Blast radius is limited to Concrete CMS instances below 9.5.3 with administrators who interact with attacker-controlled content while authenticated. No lateral movement or downstream system compromise is scored. Because exploitation depends on an administrator session and a visited malicious page, opportunistic mass exploitation is unlikely, but targeted social-engineering of site admins is feasible.

Detection Guidance

Sigma Rule

title: Concrete CMS CSRF PageTemplate Activation (CVE-2026-81924)
id: 8f2c1a44-7b9e-4d3a-9c11-6e5b0a2f9d71
status: experimental
description: Detects POST requests abusing the Concrete CMS theme Inspect activate_files action to create PageTemplate records without anti-CSRF validation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-81924
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_path:
    cs-uri-stem|contains:
      - 'activate_files'
      - 'page_templates'
  selection_body:
    cs-uri-query|contains: 'pageTemplates'
  condition: selection_method and (selection_path or selection_body)
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs(User-Agent)
  - cs(Referer)
falsepositives:
  - Legitimate administrator theme inspection and template activation
level: low
tags:
  - attack.t1190
  - cve.2026.81924

YARA Rule

rule CVE_2026_81924_Concrete_CSRF_Exploit
{
    meta:
        description = "Detects web content associated with Concrete CMS activate_files CSRF exploitation attempts (CVE-2026-81924)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-81924"
        date = "2026-01-01"

    strings:
        $a = "activate_files" ascii wide nocase
        $b = "pageTemplates" ascii wide nocase
        $c = "PageTemplate" ascii wide nocase
        $d = "Concrete CMS" ascii wide nocase
        $e = "<form" ascii wide nocase
        $f = "submit()" ascii wide nocase

    condition:
        uint16(0) == 0x3C3F or 2 of ($a, $b, $c, $d) or (1 of ($a, $b) and 1 of ($e, $f))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-81924 Concrete CMS CSRF PageTemplate Activation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"activate_files"; nocase; http.request_body; content:"pageTemplates"; nocase; reference:cve,2026-81924; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-81924; classtype:attempted-admin; sid:2026819201; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where http.request.method == "POST" and
      stringContains(http.request.body, "pageTemplates") ]
  [ network where http.request.method == "POST" and
      stringContains(url.path, "activate_files") ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=pan:traffic
| search (cs_method=POST OR http_method=POST)
| search (uri_path="*activate_files*" OR uri_query="*pageTemplates*" OR form_data="*pageTemplates*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths values(uri_query) as query
        by src_ip, http_user_agent, cs_Referer, cs_Username
| where count >= 1
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,concrete_cms,csrf,">
  <rule id="20268192" level="6">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>activate_files</url>
    <description>CVE-2026-81924: Possible Concrete CMS CSRF PageTemplate activation attempt (activate_files POST).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_81924,</group>
  </rule>

  <rule id="20268193" level="8">
    <if_sid>20268192</if_sid>
    <match>pageTemplates</match>
    <description>CVE-2026-81924: Concrete CMS activate_files request with pageTemplates[] parameter observed.</description>
    <group>cve_2026_81924,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The CNA title states "before 9.5.3," indicating version 9.5.3 as the likely fixed release, but no vendor advisory, changelog entry, or patched-source evidence is present in the provided data. Treat any specific patch reference as unverified.

1. Immediate mitigations

   • Restrict administrative access to the Concrete CMS dashboard (e.g., IP allowlisting, VPN, or HTTP authentication in front of /dashboard-style paths) so that admin sessions are not reachable in the context of ordinary web browsing.
   • Where feasible, disable or restrict the theme Inspect functionality until a fix is available.
   • Enforce a strict Content-Security-Policy and deploy perimeter rules that flag cross-origin POSTs carrying pageTemplates parameters (see detection rules above).
   • Educate administrators not to browse untrusted sites while authenticated to the CMS; consider separate browser profiles for admin work.
   • Apply SameSite=Strict cookies at the web server/reverse proxy layer where possible to reduce cross-site session riding (defense in depth).

2. Patch / upgrade steps

   • No confirmed patch or vendor advisory exists in the provided data. Monitor the Concrete CMS security advisories and release notes for a fixed release (indicated as 9.5.3 in the CNA title).
   • Do not deploy an unverified "fix." Validate any update against the official Concrete CMS release channel before applying.
   • Once a fixed version is released, test in a staging environment and then upgrade production promptly.

3. Long-term hardening

   • Require anti-CSRF token validation on all state-changing dashboard actions, especially those creating configuration records such as PageTemplate entries.
   • Adopt a framework-wide CSRF middleware rather than per-action checks.
   • Add automated regression tests for CSRF protection on administrative actions.
   • Implement change auditing/logging for configuration modifications (template activation) to detect unauthorized changes early.

References

• NVD — CVE-2026-81924: https://nvd.nist.gov/vuln/detail/CVE-2026-81924
• CWE-352 — Cross-Site Request Forgery (CSRF): https://cwe.mitre.org/data/definitions/352.html
• Concrete CMS project / security advisories: https://www.concretecms.org/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: None available in the provided data. CISA KEV: NO. No public exploit code or PoC has been observed. The EPSS score is 0.00177 (7.5th percentile), indicating a low predicted likelihood of exploitation in the near term. The reporter credited by the Concrete CMS security team is Andrew Gonzalez.