CVE-2026-81902

Concrete CMS versions 9 through 9.5.2 fail to validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker can host a crafted request (e.g., a malicious link or embedded image) that, when triggered by an authenticated user with edit permission on a target page, silently deletes every block on that page's current version. Blocks not aliased elsewhere or saved to a scrapbook are also purged from the global Blocks table and their block-type data tables, permanently destroying content. Any site running Concrete CMS 9.x up to and including 9.5.2 where editors can be lured to attacker-controlled content is affected. No public proof of concept exists and no exploitation has been observed.

What to do: Upgrade Concrete CMS to a release newer than 9.5.2 as soon as a fixed version is available. Review page version history and the global Blocks table for unexplained deletions, and verify backups can restore purged block-type data since removal from data tables is permanent. Warn users with page-edit permissions against following untrusted links while authenticated to the CMS, and consider a WAF rule flagging unexpected POSTs to the removeOrphanedBlocks action.