Vulnerability Details CVE-2026-81913
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow, giving a second entry point on sites with registration enabled. Concrete CMS versions prior to 9.5.0 do not include the rcURL parameter or this allowlist and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Michal M. for reporting.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 47.3%
CVSS Severity
CVSS v3 Score 6.1
References
Products affected by CVE-2026-81913
-
cpe:2.3:a:concretecms:concrete_cms:9.5.0
-
cpe:2.3:a:concretecms:concrete_cms:9.5.1
-
cpe:2.3:a:concretecms:concrete_cms:9.5.2