Concrete CMS CVE-2026-8411

The victim must be an authenticated Concrete CMS user with sufficient privileges to perform bulk page deletion (typically an administrator or editor role) and must hold an active browser session at the time of exploitation. The CVSS v4.0 AT:P (Attack Requirements: Present) signals that a specific precondition exists beyond mere network access - specifically, the victim's authenticated session state. UI:P (User Interaction: Passive) requires that the victim load or navigate to attacker-controlled web content, such as a malicious page, email, or embedded iframe, while logged into the CMS. Exploitation is limited to the Concrete CMS 9.x branch (versions 9.0 through 9.5.0); other major versions are not confirmed affected. The attack is scoped to page deletion integrity impact only - no confidentiality breach or service disruption is possible via this vector per the CVSS impact metrics.

Real-world risk is low. The vendor-assigned CVSS v4.0 score of 2.3 accurately reflects the constrained threat model: the attack requires AT:P (specific preconditions, i.e., victim must hold an active authenticated session with sufficient privileges to delete pages) and UI:P (passive user interaction - the victim must navigate to or load attacker-controlled content). The integrity impact is scored VI:L with no confidentiality or availability impact, suggesting the scope of deletable content may be limited or reversible. No EPSS data was provided, and this CVE is not listed in the CISA KEV catalog, meaning no confirmed active exploitation exists. No public proof-of-concept exploit has been identified. Overall, this is a genuine but low-severity issue: exploitable under realistic conditions if an admin can be socially engineered to visit a malicious page, but the limited integrity impact and required preconditions substantially reduce the threat compared to higher-scored CSRF vulnerabilities affecting authentication or privilege escalation flows.

An attacker creates a malicious web page containing an auto-submitting HTML form that sends a POST request to the target Concrete CMS instance's /concrete/controllers/dialog/page/bulk/delete endpoint with a crafted payload specifying page IDs. The attacker socially engineers an authenticated Concrete CMS administrator - for example via a phishing email - into visiting the malicious page while their CMS session remains active. Upon page load, the form silently submits, and the CMS processes the deletion request under the administrator's session, removing the targeted pages without the victim's awareness. No public proof-of-concept code has been identified at time of analysis.