Executive brief
Concrete CMS, a content management system used to build and manage websites, had a missing anti-CSRF token validation flaw in its page block arrangement feature. An attacker could trick a logged-in content editor into visiting a malicious webpage, which would automatically reorder or move content blocks on pages the victim could edit, potentially corrupting the page layout or losing work. The vulnerability required the victim to be already logged in and actively using the CMS.
Technical details
This is a Cross-Site Request Forgery (CSRF) vulnerability in the ArrangeBlocks backend controller's arrange() action. The vulnerable endpoint enforced page-edit authorization but failed to validate anti-CSRF tokens, while also accepting any HTTP method without restriction. An attacker can craft a malicious page containing an auto-submitting form that invokes the arrange() action with forged parameters. If a signed-in content editor visits the attacker's page, the victim's session cookie is sent with the request (due to the default null SameSite cookie configuration), allowing the attacker to reorder or move blocks in draft versions of pages the victim has edit permissions for. No patch availability information is explicitly stated in the advisory, though the vulnerability affects versions below 9.5.3.
Affected products
- Concrete CMS Concrete CMS below 9.5.3
Timeline
- 2026-09-15: disclosed