Is there a patch available for CVE-2026-8240?

Yes, a patch is available for CVE-2026-8240. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8240

Q: What is the CVSS score of CVE-2026-8240?

CVE-2026-8240 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31358 MEDIUM

Improper Access Control (CWE-284)

2026-05-21 ConcreteCMS

GHSA-vpgr-cwfx-pwfw

Authentication Bypass Concrete Cms

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:44 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the existence of private, draft, and restricted pages while leaking title, path, description, and author information. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

AnalysisAI

Unauthenticated page metadata disclosure in Concrete CMS 9.5.0 and below exposes private, draft, and restricted page details - including title, URL path, description, and author - to any remote attacker on sites with summary templates configured. The flaw stems from improper access control (CWE-284) where the summary template rendering pipeline bypasses page visibility restrictions entirely, making sensitive page structure visible without any credential. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis; the CVSS v4.0 score of 6.3 with AT:P reflects that exploitation depends on a non-universal template configuration being present.

Technical ContextAI

Concrete CMS is a PHP-based content management system with a templating layer that renders page summaries for navigation, search, and listing features. The vulnerability is rooted in CWE-284 (Improper Access Control): when a page is assigned a summary template, the template rendering pathway exposes metadata without evaluating whether the requesting principal has read permission on the underlying page. This affects all page types - draft, private, and access-restricted - that have a summary template configured, meaning the confidentiality guardrails applied at the page level do not propagate to the template-rendered metadata output. CPE cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* covers the full affected range from version 5.0 through 9.5.0 per EUVD-2026-31358.

RemediationAI

Upgrade to Concrete CMS 9.5.1, which is confirmed as the remediated release per the vendor's own release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. This is the primary and recommended fix. If immediate patching is not feasible, the specific compensating control is to audit all pages that have a summary template assigned and remove or replace summary templates from pages whose metadata must remain confidential - specifically private pages, drafts, and access-restricted content. This eliminates the disclosure pathway for those pages but will suppress summary rendering in navigation and listing blocks where those templates were in use, which may visually impact site functionality. No generic network-layer mitigation (WAF rules, IP restrictions) can reliably block this without understanding which page URLs are summary-template-enabled, making the template audit the most targeted and precise interim control.