Is there a patch available for CVE-2026-8414?

Yes, a patch is available for CVE-2026-8414. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8414

Q: What is the CVSS score of CVE-2026-8414?

CVE-2026-8414 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31370 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-98qf-jvwj-2r5f

CSRF Concrete Cms

2.3

CVSS 4.0 · Vendor: ConcreteCMS

Severity by source

Vendor (ConcreteCMS) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ConcreteCMS) · only source for this CVE.

CVSS VectorVendor: ConcreteCMS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:37 vuln.today

DescriptionCVE.org

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Cross-site request forgery in Concrete CMS 9.x before 9.5.0 permits a remote unauthenticated attacker to trigger unauthorized event duplication on behalf of an authenticated user by luring that user to an attacker-controlled page. The vulnerable endpoint is concrete/controllers/dialog/event/duplicate, which lacks CSRF token validation. The vendor-assigned CVSS v4.0 score of 2.3 reflects genuinely low impact - limited to a low-integrity effect on the vulnerable system - and no public exploit code or CISA KEV listing has been identified at the time of analysis.

Technical ContextAI

Concrete CMS is a PHP-based content management system. The vulnerability resides in the event duplication dialog controller at concrete/controllers/dialog/event/duplicate, which processes state-changing requests without validating a CSRF token, making it susceptible to CWE-352 (Cross-Site Request Forgery). In CSRF attacks, the victim's browser automatically attaches session credentials to cross-origin requests, allowing an attacker's crafted page to issue authenticated actions without possessing those credentials. The CVSS v4.0 vector component AT:P (Attack Requirements: Present) is notable - it indicates exploitation relies on conditions outside the attacker's direct control, specifically the victim maintaining an active authenticated session at the time of the forged request. The affected CPE is cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* across the 9.x branch.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later. While the CVE description states the fix is present in 9.5.0, the vendor's referenced release notes URL points to version 9.5.1 (https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes), indicating that 9.5.1 is the safer confirmed target version. If immediate upgrade is not possible, restrict access to the path /concrete/controllers/dialog/event/duplicate at the web server or WAF layer to prevent external requests; note this will disable the event duplication dialog for all users. As an additional defense-in-depth measure, ensure session cookies have the SameSite attribute set to Strict or Lax, which browsers honor by blocking cross-site cookie transmission and mitigates CSRF generically - though this is not a substitute for patching and may affect cross-site integrations.