Concrete CMS prior to version 9.5.3 is vulnerable to CSRF in the theme page-template activation feature. The activate_files() action in the Dashboard theme Inspect controller creates PageTemplate records from attacker-supplied pageTemplates[] values without verifying an anti-CSRF token. This allows remote attackers to craft a page that auto-submits a forged POST request, which, when visited by a signed-in administrator, executes under their session and modifies site configuration by creating theme page-template records without consent. The vulnerability is assigned CVE-2026-81924 and has a CVSS v4.0 base score of 2.1.

An attacker can cause a signed-in administrator to unknowingly perform unauthorized actions that create theme page-template records, thereby changing site configuration. The impact is limited to configuration changes and requires the administrator to visit a malicious page. The vulnerability does not allow for privilege escalation, data disclosure, or denial of service. The CVSS score reflects a low severity impact.

A fix is available in Concrete CMS version 9.5.3 and later. Users should upgrade to version 9.5.3 or newer to remediate this CSRF vulnerability. Until upgraded, administrators should avoid visiting untrusted web pages while logged into the Concrete CMS Dashboard to reduce risk.