VIR Vulnerability Intelligence Relay

CVE-2026-8435

medium
Published 2026-05-21 · Modified 2026-05-22
CVSS v3
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v2
—
VIR risk
6.5

Description

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

Predictions

Exploit likelihood
75%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: ff5b8ace-8b95-4078-9743-eac1ca5451de — https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

Application impact
VendorProductVersionsFixed
concretecmsconcrete_cms{"startIncluding":"9.0","endExcluding":"9.5.1"}9.5.1

References

CWEs

CWE-352 CWE-1275

Verify integrity in audit chain (admin only). AS-IS.