---
id: CVE-2026-81909
title: >-
  Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the
  orphaned-block alias route, allowing an authenticated editor to disclose and
  force-delete arbitrary blocks
summary: >-
  Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the
  block alias route (Process::alias() in
  concrete/controllers/backend/block/process.php).It does not verify that the
  referenced block is genuinely orphaned on the t…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Concrete CMS
product: Concrete CMS
affected:
  - concrete_cms >= 9.0.0 <= 9.5.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-11T17:58:10.598724Z'
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T17:58:35.013Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81909'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
tags:
  - cve.org
epss: 0.00441
epssPercentile: 0.35578
ingestedAt: '2026-09-14T00:35:28.535Z'
---

## Overview

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php).It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the source block. A user granted only an area-scoped add_block_to_area delegation on their own page can therefore pass any block ID on the site: the source block's content is duplicated into an area the rogue editor controls, disclosing that content, and the original block is then force-deleted in the same request, destroying arbitrary site content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

## Affected

- `concrete_cms >= 9.0.0 <= 9.5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.