In Concrete CMS versions 9.2.0 through 9.5.2, the REST API endpoint for updating pages does not properly enforce authorization checks on page properties, templates, and types. Consequently, a user with limited content-editing permissions can alter these attributes via the API. Additionally, the user can set the header_extra_content attribute to inject unescaped JavaScript into the head element of every page, resulting in persistent cross-site scripting (XSS) that affects all visitors, including higher-privileged reviewers who approve page versions. This vulnerability was reported by Yonatan Drori from Tenzai and assigned CVE-2026-81901 with a CVSS v4.0 score of 7.2.

An attacker with content-editing rights can escalate their influence by modifying page properties, templates, and types without proper authorization. They can also inject persistent JavaScript that executes in the browsers of all page visitors, including privileged users, potentially leading to session hijacking, credential theft, or unauthorized actions performed by higher-privileged users. This elevates the risk of privilege escalation and widespread cross-site scripting attacks within affected Concrete CMS installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict content-editing permissions to trusted users only and monitor for suspicious API activity. Avoid granting content-editing rights to untrusted users, as they could exploit this vulnerability to inject malicious scripts. Follow updates from the Concrete CMS security team for official patches or workarounds.