Is there a patch available for CVE-2026-7879?

Yes, a patch is available for CVE-2026-7879. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-7879

Q: What is the CVSS score of CVE-2026-7879?

CVE-2026-7879 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31356 MEDIUM

Missing Authorization (CWE-862)

2026-05-21 ConcreteCMS

GHSA-fqg3-8w8r-8g94

PHP Authentication Bypass Concrete Cms

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:39 vuln.today

DescriptionCVE.org

In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission-restricted files bypasses the view_file permission check. Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Youssef Eid for reporting

AnalysisAI

Unauthorized file download in Concrete CMS 9.5.0 and below exposes permission-restricted files via a broken authorization check in the file download controller. The submit_password() method in download_file.php processes file access without enforcing the view_file permission gate, producing two exploitable paths: any unauthenticated network actor can retrieve files that carry no password protection, and any actor who possesses a file's password can retrieve that file regardless of whether their account holds view_file permission. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Concrete CMS is a PHP-based content management system (CPE: cpe:2.3:a:concrete_cms:concrete_cms). The vulnerability resides in the single-page controller concrete/controllers/single_page/download_file.php, specifically in the submit_password() method responsible for handling authenticated file downloads. The root cause is classified as CWE-862 (Missing Authorization): the method validates password correctness but never calls or checks the view_file permission before granting the file stream. This is a classic confused-deputy pattern - the password check acts as a gate, but it is not coupled to the authorization layer that controls which users may access which files. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N) reflects network reachability combined with the prerequisite that the attacker must possess specific knowledge (a file password or a file identifier) before the bypass yields results.

RemediationAI

Upgrade to Concrete CMS 9.5.1, which is indicated as the patched release per the vendor's release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. The exact fix version (9.5.1) is inferred from the reference URL rather than explicitly stated in the advisory text, so administrators should verify against the official changelog before deploying. If an immediate upgrade is not feasible, a compensating control is to remove password protection from sensitive files and instead rely solely on CMS-level view_file permissions enforced through other controller paths that are not affected by this bypass; this eliminates the password-submission code path as an attack vector but trades the password-layer convenience. Alternatively, restrict network access to the file download endpoint (/download_file) to authenticated, known-IP ranges at the web server or reverse-proxy layer - this raises the bar for unauthenticated exploitation given AC:H is already required.