CVE-2026-81920

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3

Description Cross-Site Request Forgery (CSRF) exists in the dashboard SEO Excluded Words page. The reset() controller action clears the administrator-configured reserved-word list concrete.seo.exclude words without validating the anti-CSRF token or restricting requests to the POST method. A remote attacker could lure an authenticated user with SEO access to a crafted page to revert the reserved-word list to its default. This action silently alters future URL-slug generation for pages, files, topics, and other objects created through the Text urlify service, effectively undoing the site's configured SEO slug policy.

Recommendations Update to version 9.5.3.