CVE-2026-81913

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-81913

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81913.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-81913

Published

2026-09-11T19:30:50Z

Modified

2026-09-13T03:47:17Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.

Details

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow, giving a second entry point on sites with registration enabled. Concrete CMS versions prior to 9.5.0 do not include the rcURL parameter or this allowlist and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Michal M. for reporting.

Database specific

{
    "cna_assigner": "ConcreteCMS",
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81913.json"
}

References

Affected packages

Git / github.com/concretecms/concretecms

Affected ranges

Type

GIT

Repo

https://github.com/concretecms/concretecms

Events

Introduced

c747e425266ac50c12b5f2f74fa895ecec5cd777

Last Affected

8fe9708072c3815a5df719b592e4b23b43b4ff7a

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "9.5.0"
        },
        {
            "last_affected": "9.5.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

9.*

9.5.0

9.5.1

9.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81913.json"