---
id: CVE-2026-81913
title: >-
  Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via
  the rcURL parameter
summary: >-
  Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via
  the rcURL parameter. An attacker can craft a single link on the site's own
  domain that sends a user to an arbitrary external site immediately after
  authenticat…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-601
vendor: concretecms
product: concrete_cms
affected:
  - 'concrete_cms >= 9.5.0, < 9.5.3'
patched:
  - concrete_cms 9.5.3
published: '2026-09-11'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:13:27.500'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81913'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
epss: 0.00291
epssPercentile: 0.1931
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T19:35:51.777667Z'
scores:
  nvd: 6.1
  cna: 5.3
ingestedAt: '2026-09-14T00:35:28.533Z'
---

## Overview

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow, giving a second entry point on sites with registration enabled. Concrete CMS versions prior to 9.5.0 do not include the rcURL parameter or this allowlist and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Michal M. for reporting.

## Affected

- `concrete_cms >= 9.5.0, < 9.5.3`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.3`