CVE-2026-81912

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3

Description Cross-Site Request Forgery (CSRF) exists in the Move Multiple Groups feature. The endpoint 'dashboard/users/groups/bulkupdate/confirm()' allows moving selected group tree nodes without validating an action token. This allows a state-changing group move to be processed for an authenticated user who did not initiate the request. Since relocating a group under a new parent causes members to inherit the parent's permissions, a forged move can alter effective authorization.

Recommendations Update to version 9.5.3.