Concrete CMS prior to version 9.5.3 does not enforce object-level authorization when a Page Type is updated. The Types::submit() dashboard controller loads and saves the Page Type identified by a user-supplied ptID without invoking the canEditPageType() check. Consequently, a dashboard user authorized to edit a single Page Type can alter configurations of other Page Types beyond their assigned permissions. The update_page_type token validation is insufficient as it is scoped to the action and user, not the specific object, allowing unauthorized modifications. The vulnerability is tracked as CVE-2026-81915 and has a CVSS v4.0 base score of 5.1.

An authenticated dashboard user with permission to edit at least one Page Type can exploit this vulnerability to modify other Page Types outside their authorization boundary. This could lead to unauthorized configuration changes within the CMS, potentially impacting site behavior or security controls tied to Page Types. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the dashboard user’s existing permissions.

Upgrade Concrete CMS to version 9.5.3 or later, where this vulnerability has been addressed by adding proper object-level authorization checks when updating Page Types. No other mitigation or workaround is indicated. Patch status is not explicitly stated in the input, but the version 9.5.3 is referenced as the fixed version, so updating to 9.5.3 or newer is recommended.