Is there a patch available for CVE-2026-8410?

Yes, a patch is available for CVE-2026-8410. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8410

Q: What is the CVSS score of CVE-2026-8410?

CVE-2026-8410 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31376 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-v7c7-658v-hh7v

CSRF Concrete Cms

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:33 vuln.today

DescriptionCVE.org

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete. The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Cross-Site Request Forgery in Concrete CMS 9.x allows an unauthenticated remote attacker to delete application logs on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerable endpoint is concrete/controllers/dialog/logs/bulk/delete, and exploitation results in low-integrity impact - specifically, destruction of audit log data. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS v4.0 score of 2.3 reflects the combination of required user interaction and the presence of attack prerequisites.

Technical ContextAI

Concrete CMS is a PHP-based content management system. The vulnerability resides in the bulk log deletion dialog controller (concrete/controllers/dialog/logs/bulk/delete) and is classified under CWE-352 (Cross-Site Request Forgery). CSRF occurs when a web application processes state-changing requests without verifying that the request originates from the authenticated user's own session, rather than from a forged request issued by a third-party page. The affected CPE is cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:*, covering Concrete CMS version 9 series through 9.5.0 per EUVD data. The CVSS v4.0 vector assigns AT:P (Attack Requirements: Present), reflecting that a prerequisite condition - specifically an authenticated victim session - must exist for the attack to succeed.

RemediationAI

The primary fix is to upgrade Concrete CMS to version 9.5.1, per the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. Note that there is a minor discrepancy between the CVE description ('9 before 9.5.0') and EUVD data ('≤9.5.0'); verify the exact fixed version against the linked release notes before concluding 9.5.0 is safe. If immediate upgrade is not possible, the specific compensating control is to restrict access to the /concrete/controllers/dialog/logs/bulk/delete endpoint at the web server or WAF layer - this will prevent the forged request from being processed but will also disable the bulk log deletion UI feature for legitimate administrators. Alternatively, enforce strict Referer/Origin header validation via WAF rules to block cross-origin form submissions to that endpoint. Neither workaround is a substitute for patching.