CVE-2026-81902: Concrete CMS: CSRF in removeOrphanedBlocks deletes page content

Concrete CMS 9 through 9.5.2 skips CSRF token validation on the orphaned block removal action, so an attacker can get an authenticated editor to load a crafted link or page that wipes every block on the target page and permanently deletes unaliased block data from the database. Note that this is a general-purpose CMS flagged with an ml_ui category and no tracked AI package, so its AI/ML relevance is marginal and only matters if it fronts AI documentation, model portals or content feeding RAG pipelines. Exploitation likelihood is low-to-moderate (EPSS 0.24%, 86th percentile), with no public exploit, no Nuclei template, no KEV listing and a CISA SSVC decision of TRACK. The impact is integrity and availability loss of content rather than data theft, and it requires user interaction from someone with edit permission. Upgrade to the fixed release noted in the Concrete CMS 9.5.3 release notes and verify that recent backups of the CMS database exist.

No confirmed active exploitation of CVE-2026-81902 has been reported, but organizations should still patch proactively.

1) Upgrade Concrete CMS to 9.5.3 or later per the vendor release notes. 2) Until patched, restrict edit permissions to the minimum number of users and avoid browsing untrusted links while logged in to the CMS admin. 3) Ensure SameSite cookie attributes are set to Lax or Strict on the session cookie. 4) Maintain and test regular database and file backups to allow recovery of deleted blocks. 5) Monitor web logs for requests to the removeOrphanedBlocks panel action with external or missing Referer headers, and for sudden mass block deletions.

This vulnerability affects the following AI/ML architecture patterns: Web content management systems, Documentation and knowledge portals feeding RAG pipelines.

CVE-2026-81902 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.24%.