{"id":21707,"date":"2026-09-12T08:31:08","date_gmt":"2026-09-12T00:31:08","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81907"},"modified":"2026-09-12T08:31:08","modified_gmt":"2026-09-12T00:31:08","slug":"cve-2026-81907","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81907","title":{"rendered":"CVE-2026-81907 &#8211; Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Exp"},"content":{"rendered":"<p>Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express &#8220;Clear Entries&#8221; function (POST \/index.php\/dashboard\/system\/express\/entities\/delete_entries) because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation to proceed when the token is missing or invalid. A remote unauthenticated attacker can force an authenticated administrator who visits an attacker-controlled page to permanently delete all entries belonging to an attacker-selected Express entity on a web application to which the administrator is currently authenticated. Because the default Contact Express object ships with a fixed entity UUID, the target identifier can be obtained without dashboard access.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.1 with vector CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:P\/VC:N\/VI:H\/VA:H\/SC:N\/SI:N\/SA:N. Thanks Pratik Zanjurne for reporting.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express &#8220;Clear Entries&#8221; function (POST \/index.php\/dashboard\/system\/express\/entities\/delete_entries) because the c<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21707","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21707","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21707"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21707"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21707"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}