Concrete CMS CVE-2026-8409

The victim must be an authenticated Concrete CMS user with sufficient privileges to delete application logs, and must visit an attacker-controlled web page while their CMS session cookie is valid and active in the browser. The AT:P metric in the CVSS v4.0 vector confirms that attack prerequisites are 'Present,' meaning exploitation cannot occur without this simultaneous authenticated-session condition. Exploitation is limited by the requirement for social engineering or a watering-hole scenario to deliver the forged request, the need for an active authenticated session at the exact time of the visit, and the narrow impact scope (log deletion only - no credential theft or code execution). The attack does not require any special server-side configuration beyond a reachable Concrete CMS 9.x instance running a version before 9.5.0.

The overall risk is low. The CVSS v4.0 score of 2.3 reflects a narrow impact: only the Vulnerable System Integrity is affected (VI:L), with no confidentiality, availability, or subsequent-system impact. The AT:P metric indicates prerequisites must be in place - namely, an authenticated CMS user must be socially engineered into visiting an attacker-controlled page while actively logged into Concrete CMS. UI:P (passive user interaction) means the user need not click a specific button, but the browser must still initiate the forged cross-origin request. EPSS data is not available in the provided intelligence, though the low CVSS and absence of KEV listing or POC both suggest low exploitation probability. The practical impact - unauthorized log deletion - could assist an attacker in covering tracks after a separate compromise, making this slightly more relevant in post-exploitation contexts than its raw score implies. No conflicting signals are present; all available data consistently points to low-severity, low-priority remediation.

An attacker crafts a malicious web page containing a hidden HTML form or auto-submitting JavaScript that issues a POST request to the target Concrete CMS instance's log deletion endpoint. If an authenticated CMS administrator visits the attacker's page while their CMS session is active, the browser automatically includes the session cookie, and the server processes the deletion request without verifying the request's origin. No public exploit code has been identified at time of analysis.