Executive brief
Concrete CMS is a web content management system used to build and manage websites. A missing security check (CSRF token validation) in the orphaned block removal feature allows an attacker to craft a malicious request that, when visited by an authenticated editor, permanently deletes all blocks and associated content on a page. This results in irreversible data loss and potential service disruption.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) token validation bypass in the removeOrphanedBlocks panel action. Concrete CMS 9 through 9.5.2 fail to properly validate anti-CSRF tokens before processing the orphaned block removal request. An unauthenticated attacker can craft a malicious request that, when executed in the browser context of an authenticated user with edit permissions on a target page, triggers deletion of all blocks on that page's current version. Blocks that are not aliased to other pages or scrapbook entries are also permanently removed from the global Blocks table and their corresponding block-type data tables. No patches are mentioned in the advisory as available at the time of publication.
Affected products
- Concrete CMS Concrete CMS 9 through 9.5.2
Timeline
- 2026-09-14: disclosed