CVE-2026-81901

Concrete CMS 9.2.0 through 9.5.2 fails to enforce page-property, page-template, and page-type authorization on the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}). A user with only content-editing rights on a page can abuse this endpoint to modify the page's properties, template, and type — changes they should not be able to make. Critically, the attacker can set the header_extra_content attribute, which is rendered unescaped into the head element of every page, persisting JavaScript that executes in the browser of every visitor, including higher-privileged reviewers who approve the page version (enabling session or action hijacking). The Concrete CMS security team rated the flaw CVSS v4.0 7.2 (high), noting it requires attacker setup, high privileges (content editing), and user interaction. No public proof of concept exists and there is no evidence of exploitation in the wild.

What to do: Upgrade Concrete CMS to the latest release newer than 9.5.2, which contains the authorization fix for the REST API page update endpoint. If the REST API is not needed, disable it or restrict API tokens/access to trusted administrators only. Inspect existing pages' header_extra_content attributes for unexpected JavaScript and review API/server logs for PUT requests to /ccm/api/1.0/pages/{cID} made by content-editor accounts, since any tampering there may indicate prior abuse.