CVE-2026-8347
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering.
Risk Assessment
A user with limited privileges can alter entity ordering, potentially disrupting application functionality or enabling further attacks.
Recommendation
Update Concrete CMS to version 9.5.1 or later, which includes a fix for this issue.
Other vulnerabilities in Concrete CMS
See all- CVE-2026-10721High
Vulnerability in Concrete CMS below version 9.5.2 allows an unauthenticated attacker to perform PHP object injection via unserialize() calls in Permission, Cache, and Search components. The attack requires a malicious payload to be placed in the database.
- CVE-2026-7888High
Concrete CMS below version 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database.
- CVE-2026-8353Medium
Concrete CMS versions 9.0 to 9.5.0 are vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages.
- CVE-2026-8340Medium
Concrete CMS version 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. A victim with edit_file_contents permission can be tricked into publishing an attacker-chosen previously-uploaded file version (downgrade or activation of an unpublished version).
- CVE-2026-8435Medium
Concrete CMS 9 before version 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) in the approveVersion() controller. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of an administrator.
- CVE-2026-8434High
Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). An attacker can trick an administrator into performing unwanted file operations.
- CVE-2026-8433High
Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). An attacker can trick an administrator into rescanning a file.
- CVE-2026-8432High
Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). An attacker can trick an administrator into starring a file.
- CVE-2026-8427High
Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the removeFavoriteFolder($id) endpoint. An attacker can exploit this to perform unauthorized actions on behalf of the victim.
- CVE-2026-8416High
Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the addFavoriteFolder($id) endpoint. An attacker can exploit this to perform unauthorized actions on behalf of the victim.
Original NVD description (English source)
Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.