Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting… (CVE-2026-81904)

Concrete CMS versions prior to 9.5.3 improperly register view assets for all sub-blocks within a Stack, Container, or layout area without checking user permissions. This flaw enables unauthenticated users to retrieve configuration values emitted by restricted sub-blocks' asset registrations, including sensitive data like API keys, from public pages embedding these components. The issue stems from missing permission checks at the asset registration stage for sub-blocks. The vulnerability has been assigned CVE-2026-81904 and a CVSS v4.0 base score of 6.3 (medium severity).

An unauthenticated attacker can extract sensitive configuration information from restricted sub-blocks embedded in public pages, potentially exposing confidential data such as API keys. This bypasses intended block-level permission controls, leading to information disclosure without requiring authentication.

A fix is available in Concrete CMS version 9.5.3 and later. Users should upgrade to version 9.5.3 or above to remediate this vulnerability. Patch status is not explicitly confirmed in the provided data, but the version cutoff indicates remediation in 9.5.3. Until upgraded, restrict public exposure of pages embedding affected Stacks, Containers, or layout areas that include sensitive sub-blocks.