Concrete CMS CVE-2026-8414

Exploitation requires the victim to be actively authenticated to the Concrete CMS installation - specifically, a user with access to the event management functionality - and must be induced to visit an attacker-controlled web page or trigger a crafted HTTP request (reflected in CVSS UI:P and AT:P). The AT:P component explicitly encodes that the attacker depends on conditions outside their control: the victim's authenticated session must be live at the time of the forged request. PR:N confirms no attacker-side account is required on the CMS. Limiting factors: (1) victim must be logged into Concrete CMS at the time of attack, (2) victim must interact with or visit an attacker-controlled resource, (3) impact is restricted to unauthorized event duplication with low integrity effect - no data exfiltration, no account takeover, no availability impact. Default SameSite cookie behavior in modern browsers (Chrome 80+, Firefox 79+) set to Lax by default also partially mitigates this class of CSRF for top-level navigations.

The CVSS v4.0 score of 2.3 with vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N is consistent with a low-priority issue. While the attack vector is network-based and complexity is low, the AT:P component introduces a meaningful real-world dependency: the attacker cannot directly trigger the vulnerability without an authenticated victim visiting a malicious page. Impact is confined to a low integrity effect (VI:L) on the vulnerable system, with no confidentiality, availability, or downstream system impact. No EPSS score was provided in the intelligence data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists and no public exploit code has been identified - this is not a real-world priority vulnerability. The CVSS score and qualitative signals are fully aligned: this is a low-severity finding appropriate for inclusion in a regular patch cycle rather than emergency response.

An attacker crafts a malicious webpage containing a hidden HTML form or JavaScript fetch that auto-submits a forged POST request to the Concrete CMS event duplication endpoint. The attacker distributes this page via phishing email targeting known CMS administrators. When an authenticated editor visits the page, their browser sends the request with the active session cookie attached, causing the CMS to silently duplicate an event without the user's knowledge. No public exploit code has been identified at the time of analysis, and exploitation requires social engineering to induce user interaction.