CVE-2026-81913CWE-601

CVE-2026-81913

Medium · published September 12, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow, giving a second entry point on sites with registration enabled. Concrete CMS versions prior to 9.5.0 do not include the rcURL parameter or this allowlist and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Michal M. for reporting.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00291 · 20.6th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-09-12T00:19Z
Affected products (1)
ProductVersionsFixed in
concretecms/concrete_cms≥ 9.5.0, < 9.5.39.5.3
References (1)
https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes · ff5b8ace-8b95-4078-9743-eac1ca5451de
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 1%
    epss
  • 11 SEP 19:30Z
    Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.
    cvelistv5