Concrete CMS CVE-2026-8203

Attacker must possess editor-level credentials on the target Concrete CMS instance (PR:H) - anonymous or visitor-tier accounts cannot trigger the vulnerability. A second user must subsequently load the page or block containing the malicious height value for the payload to fire (UI:P), so a passive editor injection without victim interaction yields no impact. Attack complexity is rated High (AC:H) and attack requirements are present (AT:P), suggesting that successful exploitation depends on knowledge of the specific affected controller endpoint and the height parameter's render path. Limited to Concrete CMS 9.5.0 and earlier; deployments where editor accounts are restricted to highly-trusted internal staff face substantially lower realistic risk.

The CVSS 4.0 vector tells a nuanced story: the network attack vector (AV:N) and high VC/VI/VA impacts suggest serious reach, but several mitigating factors reduce real-world urgency - high attack complexity (AC:H), presence of attack requirements (AT:P), high privileges required (PR:H, meaning editor-level authentication), and required user interaction (UI:P) by a victim. This is therefore not a remote unauthenticated takeover scenario; an attacker must already have editor rights and convince a victim (often an admin) to view the poisoned content. There is no public exploit identified at time of analysis, no CISA KEV listing, no EPSS data available, and no SSVC framework data provided. The realistic risk is privilege escalation from editor to administrator via admin-targeted XSS - meaningful for multi-tenant or community-editor deployments, less critical for tightly-controlled internal sites where editors are already trusted.

An attacker who has obtained or been granted editor privileges configures a block or page element setting the height parameter to a payload such as a script tag or event-handler injection. When an administrator or visitor later views the page containing that block, the stored JavaScript executes in their browser context, allowing the attacker to exfiltrate the session cookie, perform CSRF-style actions as the admin (such as creating a new admin user), or harvest credentials via injected forms. No public proof-of-concept is identified at time of analysis.