{"id":20904,"date":"2026-09-11T08:31:23","date_gmt":"2026-09-11T00:31:23","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81905"},"modified":"2026-09-11T08:31:23","modified_gmt":"2026-09-11T00:31:23","slug":"cve-2026-81905","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81905","title":{"rendered":"CVE-2026-81905 &#8211; Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email\/regist"},"content":{"rendered":"<p>Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email\/registration validation, password reset, and persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued for one purpose can be redeemed for another: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to set a new password on the target account, and a password-reset hash can be submitted to the email-validation endpoint to activate an account. Exploitation requires the attacker to first obtain a valid hash through a separate channel (for example email interception, log exposure, or SSRF against an internal mail relay), so the flaw amplifies the impact of any hash disclosure rather than creating a standalone entry point. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0\/AV:N\/AC:H\/AT:P\/PR:N\/UI:N\/VC:L\/VI:L\/VA:N\/SC:N\/SI:N\/SA:N. Thanks Yonatan Drori from Tenzai for reporting.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email\/registration validation, password reset, and persistent login) in a single table with a type column, but the redempt<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-20904","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/20904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}