Is there a patch available for CVE-2026-8347?

Yes, a patch is available for CVE-2026-8347. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8347

Q: What is the CVSS score of CVE-2026-8347?

CVE-2026-8347 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31442 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-22 ConcreteCMS

GHSA-jqvq-gv67-3567

Authentication Bypass Concrete Cms

2.3

CVSS 4.0 · Vendor: ConcreteCMS

Severity by source

Vendor (ConcreteCMS) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

AC:H reflects that Express entity ordering must be configured (non-default); PR:L for required authenticated low-privilege account; only low integrity impact with no C or A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ConcreteCMS).

CVSS VectorVendor: ConcreteCMS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:25 vuln.today

CVE Published

May 22, 2026 - 14:06 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

AnalysisAI

Concrete CMS 9.5.0 and earlier exposes an IDOR combined with an incorrect authorization level check in the Express association Reorder dialog, enabling authenticated users with only view-only permission to tamper with entity ordering state for entries they do not own. The flaw is limited to sites actively using the Concrete CMS Express application-builder feature with entity ordering configured - a non-default deployment subset. No public exploit or active exploitation has been identified; all available signals (CVSS 4.0 of 2.3, EPSS at 0.04%, SSVC exploitation: none) consistently characterize this as a low-priority, narrow-impact finding.

Technical ContextAI

Concrete CMS Express is an integrated application-builder module that allows site administrators to define custom data entities and associations. The Reorder dialog for Express associations accepts user-controlled entity identifiers (keys) to reorder entries but fails to enforce the correct authorization level - specifically, it does not verify that the requesting user holds write-level (rather than view-only) permission before committing ordering changes. This maps directly to CWE-639 (Authorization Bypass Through User-Controlled Key), where an attacker manipulates an object reference that the application fails to properly gate with adequate permission checks. The CPE cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* confirms this affects the core CMS package. The vendor's CVSS 4.0 vector includes AT:P (attack requirements: present), formally acknowledging that the Express feature with entity ordering must be configured on the target site.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, which resolves this vulnerability per the vendor's 9.5.1 release notes (https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes). Sites that are not using the Concrete CMS Express feature or are not relying on Express entity ordering are entirely unaffected and require no action. As a compensating control prior to patching, administrators can disable or restrict access to the Express association Reorder dialog - note this would prevent legitimate reordering of Express entities. Minimizing the number of accounts with even view-only Express entry permissions reduces the exploitable population further. Patch confirmed available per vendor advisory.