Concrete CMS CVE-2026-8347

Three specific conditions must all be true for exploitation: (1) the attacker must hold an authenticated account on the Concrete CMS site with at minimum view-only permission on at least one Express entry (PR:L - unauthenticated exploitation is not possible); (2) the target site must be using the Concrete CMS Express application-builder feature (not enabled or configured by default); (3) the site must be specifically relying on Express entity ordering, meaning the Reorder dialog is in active use. The CVSS 4.0 vector's AT:P flag formally encodes conditions 2 and 3 as required attack prerequisites. Sites using Concrete CMS purely for standard page/content management without Express are not affected. Impact is bounded to entity ordering manipulation - no privilege escalation, no data exfiltration, no availability disruption.

All available risk signals converge on very low real-world priority. The vendor-assigned CVSS 4.0 score is 2.3 - among the lowest possible - reflecting narrow impact (VI:L only, no confidentiality or availability impact) and the presence of attack prerequisites (AT:P). EPSS is 0.04% at the 12th percentile, meaning the exploitation probability is lower than approximately 88% of all CVEs, indicating minimal threat actor interest. SSVC confirms exploitation status as 'none' and marks the vulnerability as not automatable, with only partial technical impact. There is no CISA KEV listing and no publicly available exploit code. The primary limiting factors are that the victim site must deliberately deploy and configure Express entity ordering (non-default), and the attacker must already hold an authenticated low-privilege account (PR:L in the vendor vector). The integrity impact is confined to reordering data entries - not deletion, modification of content, or privilege escalation. This is a real finding but not an operational priority for most organizations.

An authenticated low-privilege user with view-only access to a Concrete CMS Express entry manually crafts a reorder HTTP request substituting entity IDs belonging to other entries they do not control. The Reorder dialog endpoint processes the request without validating that the user holds the required write-level permission, resulting in the ordering state of unrelated entities being altered. No public POC exists; exploitation requires knowledge of valid entity IDs and a site that has Express entity ordering deployed.