Is there a patch available for CVE-2026-7881?

Yes, a patch is available for CVE-2026-7881. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-7881

Q: What is the CVSS score of CVE-2026-7881?

CVE-2026-7881 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31355 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-21 ConcreteCMS

GHSA-chfm-cm6h-q5x7

Authentication Bypass Concrete Cms

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:40 vuln.today

Patch available

May 21, 2026 - 22:02 EUVD

DescriptionCVE.org

Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.

AnalysisAI

Unauthorized access to all Express form submissions is possible in Concrete CMS 9.5.0 and below through an Insecure Direct Object Reference (IDOR) in the Express Entry Detail block, exploitable by unauthenticated remote attackers who manipulate the exEntryID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though the AT:P metric indicates a specific deployment precondition - the Express Entry Detail block must be in active use. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in the 9.5.1 release.

Technical ContextAI

CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the application uses a client-supplied identifier - exEntryID - as the sole authorization key to retrieve an Express Entry record, without verifying that the requesting party has permission to access that specific record. Concrete CMS's Express system is a built-in form and data management framework; the Express Entry Detail block renders individual form submission records on front-end pages. Because the exEntryID value is directly user-controllable and is not validated against session ownership or ACL rules, an attacker can enumerate or directly reference arbitrary submission IDs to read form data they are not entitled to. The affected CPE is cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* covering the version range from 5.0 up to and including 9.5.0.

RemediationAI

Upgrade to Concrete CMS 9.5.1, which addresses this vulnerability per the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. If an immediate upgrade is not possible, a targeted compensating control is to remove or unpublish any pages containing the Express Entry Detail block from public access, which directly eliminates the exposed attack surface by preventing unauthenticated requests from reaching the vulnerable exEntryID parameter. Alternatively, restricting access to those pages via IP allowlist or requiring authentication at the web server or CMS permission level would limit exposure, though this may conflict with intended public-facing functionality. Note that restricting the block rather than patching leaves the underlying authorization flaw in place and should be treated as temporary only.