Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. (CVE-2026-81911)
Concrete CMS versions 9.0.0 through 9.5.2 contain a stored cross-site scripting (XSS) vulnerability in the Board Custom Slot dialog. This occurs because the save_template endpoint accepts and stores client-supplied data without properly verifying or encoding it, allowing a user with board content editing permissions to inject JavaScript payloads. These payloads execute in the browsers of users who view the affected board slot, including anonymous visitors and dashboard users, potentially leading to session or action takeover and privilege escalation. Versions prior to 9.0.0 are not affected as they lack the Boards feature.
AI Analysis
Technical Summary
The vulnerability in Concrete CMS (CVE-2026-81911) affects versions 9.0.0 to 9.5.2 and is a stored XSS in the Board Custom Slot dialog. The save_template endpoint authorizes requests only against the target board instance but stores the selectedTemplateOption[collection] data verbatim without server-side validation that each item belongs to the authorized board's data pool. This allows an authorized user to inject a malicious JavaScript payload in the description field of a summary object. The default summary template renders this field without output encoding, causing the payload to execute in any user's browser who views the board slot, including anonymous front-end users and dashboard previewers. The vulnerability has a CVSS v4.0 base score of 5.8, indicating medium severity.
Potential Impact
An attacker with permission to edit at least one board instance can inject malicious JavaScript that executes in the browsers of users viewing the affected board slot. This can lead to session or action takeover and potentially escalate privileges toward an administrator. The vulnerability affects both anonymous front-end visitors and authenticated dashboard users who preview the affected content.
Mitigation Recommendations
No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to edit board contents to trusted users only and consider disabling the Boards feature if not required. Avoid viewing or previewing untrusted board content in the dashboard.
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. (CVE-2026-81911)
Description
Concrete CMS versions 9.0.0 through 9.5.2 contain a stored cross-site scripting (XSS) vulnerability in the Board Custom Slot dialog. This occurs because the save_template endpoint accepts and stores client-supplied data without properly verifying or encoding it, allowing a user with board content editing permissions to inject JavaScript payloads. These payloads execute in the browsers of users who view the affected board slot, including anonymous visitors and dashboard users, potentially leading to session or action takeover and privilege escalation. Versions prior to 9.0.0 are not affected as they lack the Boards feature.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Concrete CMS (CVE-2026-81911) affects versions 9.0.0 to 9.5.2 and is a stored XSS in the Board Custom Slot dialog. The save_template endpoint authorizes requests only against the target board instance but stores the selectedTemplateOption[collection] data verbatim without server-side validation that each item belongs to the authorized board's data pool. This allows an authorized user to inject a malicious JavaScript payload in the description field of a summary object. The default summary template renders this field without output encoding, causing the payload to execute in any user's browser who views the board slot, including anonymous front-end users and dashboard previewers. The vulnerability has a CVSS v4.0 base score of 5.8, indicating medium severity.
Potential Impact
An attacker with permission to edit at least one board instance can inject malicious JavaScript that executes in the browsers of users viewing the affected board slot. This can lead to session or action takeover and potentially escalate privileges toward an administrator. The vulnerability affects both anonymous front-end visitors and authenticated dashboard users who preview the affected content.
Mitigation Recommendations
No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to edit board contents to trusted users only and consider disabling the Boards feature if not required. Avoid viewing or previewing untrusted board content in the dashboard.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8c9r-46mw-f22c
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-81911"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6aa4a02655bf5e2cf5a869ca
Added to database: 09/12/2026, 00:43:18 UTC
Last enriched: 09/12/2026, 01:18:46 UTC
Last updated: 09/12/2026, 01:18:46 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.