CVE-2026-8417
HighSummary
Concrete CMS versions 9.5.0 and below do not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/controllers/single_page/dashboard/extend/update.php only checks canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller.
Risk Assessment
An attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation. The target package must already be installed and the victim must be passing canInstallPackages().
Recommendation
It is recommended to implement CSRF token validation for all state-changing endpoints to prevent unauthorized package upgrades.
Original NVD description (English source)
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/controllers/single_page/dashboard/extend/update.php checks only canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller. Because the endpoint is a state-changing GET route with no token enforcement, an attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.In order to be vulnerable, the victim must be passing canInstallPackages() and and a target package must already be already installed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.