Is there a patch available for CVE-2026-8327?

Yes, a patch is available for CVE-2026-8327. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8327

Q: What is the CVSS score of CVE-2026-8327?

CVE-2026-8327 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31362 MEDIUM

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-05-21 ConcreteCMS

GHSA-wmw3-3fv3-h54w

Authentication Bypass Concrete Cms

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:41 vuln.today

DescriptionCVE.org

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks 0x4c616e for reporting.

AnalysisAI

Concrete CMS versions below 9.5.0 expose authenticated users to two related privilege-abuse primitives via a mass assignment flaw: password replacement without the current password, and disabling per-user IP-pinning that guards against session hijacking. The user-profile edit controller forwards the entire raw POST body to UserInfo::update() with no field whitelist, allowing any registered user to inject arbitrary model attributes - including the password field and session-security settings - into their own profile update. No public exploit code has been identified at time of analysis, but the attack is low-complexity and network-accessible for any authenticated user.

Technical ContextAI

The root cause is CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes, colloquially known as a mass assignment vulnerability. The affected component is the user-profile edit controller in Concrete CMS (CPE: cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:*), which hydrates a UserInfo model by passing PHP's raw $_POST superglobal directly to UserInfo::update(). Without an explicit allowlist of writable fields, any model attribute whose name matches a POST key can be overwritten. Two exploitable consequences follow: (1) the 'password' field can be set to an arbitrary value without supplying the existing credential, bypassing the standard re-authentication gate for password changes; (2) the per-user IP-pinning flag in the session validator - a control designed to detect cookie theft - can be toggled off, weakening session-hijacking protections post-authentication. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network delivery, low complexity, and no additional targeting conditions beyond holding a low-privilege account.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, which addresses the mass assignment flaw according to the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. The fix version of 9.5.1 is inferred from the reference URL naming convention and vendor disclosure; it has not been independently verified against a changelog diff. If immediate patching is not feasible, a compensating control is to restrict site registration to trusted users only, reducing the pool of low-privilege accounts that can reach the profile-edit endpoint. Additionally, administrators can audit whether per-user IP-pinning is enforced platform-wide through server-side configuration rather than relying on per-user flags, though this depends on CMS configuration options available in the installed version. Disabling user self-service profile editing entirely is a high-impact workaround that eliminates the attack surface but also removes legitimate functionality. There is no known network-layer control that would block this attack without blocking normal user profile management.