Is there a patch available for CVE-2026-8411?

Yes, a patch is available for CVE-2026-8411. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8411

Q: What is the CVSS score of CVE-2026-8411?

CVE-2026-8411 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31373 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-752x-23hp-jmv6

CSRF Concrete Cms

2.3

CVSS 4.0 · Vendor: ConcreteCMS

Severity by source

Vendor (ConcreteCMS) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ConcreteCMS) · only source for this CVE.

CVSS VectorVendor: ConcreteCMS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:36 vuln.today

DescriptionCVE.org

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Cross-Site Request Forgery in Concrete CMS 9.x through 9.5.0 allows a remote unauthenticated attacker to trigger bulk page deletion by tricking an authenticated user into visiting a malicious web page. The vulnerable endpoint is concrete/controllers/dialog/page/bulk/delete, and exploitation results in low-integrity impact against the vulnerable system. No public exploit code has been identified at time of analysis, and the Concrete CMS security team assigned a CVSS v4.0 score of 2.3, reflecting the prerequisite of passive victim interaction and the constrained impact.

Technical ContextAI

Concrete CMS is a PHP-based content management system. CWE-352 (Cross-Site Request Forgery) describes a class of vulnerabilities where a web application does not adequately verify that a state-changing request originated from the legitimate user rather than a third-party site. The affected endpoint - concrete/controllers/dialog/page/bulk/delete - handles bulk deletion of CMS pages and, in versions prior to 9.5.1, fails to enforce anti-CSRF token validation. The CPE identifier cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* covers all editions of Concrete CMS. The CVSS v4.0 vector AV:N/AC:L/AT:P/PR:N/UI:P reflects a network-reachable attack of low complexity, but requiring attack preconditions (AT:P) and passive victim interaction (UI:P), consistent with the CSRF threat model where a victim must be authenticated and visit attacker-controlled content.

RemediationAI

Upgrade Concrete CMS to version 9.5.1 or later, which contains the fix per the vendor's release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. The fix version is inferred from the reference URL pointing to the 9.5.1 release notes and the EUVD affected range ending at 9.5.0; an exact changelog entry was not independently verified. As a compensating control prior to patching, administrators can restrict access to the /concrete/controllers/dialog/page/bulk/delete endpoint via web server configuration (e.g., nginx location deny or Apache access controls limited to trusted IP ranges), though this may break bulk-delete UI functionality for legitimate users. Additionally, enforcing short session timeouts reduces the window during which an authenticated admin session can be hijacked for CSRF. Note that neither workaround substitutes for patching, as session-based controls do not eliminate the CSRF weakness.