Concrete CMS 9 through 9.5.2 suffers from a missing authorization vulnerability in the Process::alias() function located in concrete/controllers/backend/block/process.php. The function fails to verify that the block being aliased is orphaned on the target page or that the user has permission over the source block. Consequently, a user with only area-scoped add_block_to_area delegation on their own page can specify any block ID on the site, causing the source block's content to be duplicated into an area they control and then force-deleting the original block. This leads to unauthorized content disclosure and destruction of arbitrary site content. The vulnerability is tracked as CVE-2026-81909 and has a CVSS v4.0 base score of 5.9.

An attacker with delegated permission to add blocks to an area on their own page can exploit this vulnerability to duplicate content from any block on the site into their controlled area, thereby disclosing content they should not access. Additionally, the original block is force-deleted, resulting in destruction of arbitrary site content. This can lead to unauthorized data exposure and content loss within the affected Concrete CMS installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to users who have area-scoped add_block_to_area delegation to trusted individuals only to minimize risk. Monitor vendor channels for updates and apply patches promptly once released.