Concrete CMS CVE-2026-8415

Exploitation requires that the victim is actively authenticated to a Concrete CMS 9.x instance (session must be valid at the time of the forged request) and must have sufficient privileges to access the Express associations reorder dialog - this is not a public-facing anonymous endpoint. The CVSS 4.0 AT:P (Attack Requirements: Present) field further signals that additional preconditions beyond a valid session must exist, likely that the Express Objects feature is deployed and the target user has access to association management. The attacker must also successfully lure the victim to a page they control (UI:P). Exploitation is limited to low-integrity impact on association ordering within the CMS; there is no path to confidentiality compromise or availability disruption from this vulnerability alone. Non-default mitigating factor: sites that do not use the Concrete CMS Express Objects feature are not meaningfully at risk.

The overall risk is low. The CVSS v4.0 score of 2.3 is well-grounded in the vector's individual components: AV:N (network-reachable) is partially offset by AT:P (prerequisite conditions must be present), UI:P (passive user interaction required - victim must visit attacker-controlled page), and an impact profile of VI:L with no confidentiality (VC:N) or availability (VA:N) impact, and no downstream system impact (SC:N/SI:N/SA:N). No EPSS data was provided, and this CVE is not in the CISA KEV catalog, so no confirmed active exploitation signal exists. No public POC has been identified at time of analysis. The practical exploitation barrier is meaningful: the attacker must lure a user who is already authenticated and has access to Express associations into loading a malicious page. The net effect of successful exploitation is only a reordering of content associations - not data exfiltration, account takeover, or service disruption. There is a version discrepancy worth noting: the CVE description states versions 'before 9.5.0' are affected, while the EUVD record lists the affected range as '9.0 ≤ 9.5.0' (implying 9.5.0 itself is affected), and the reference URL points to 9.5.1 release notes - this conflict should be verified against the vendor advisory.

An attacker identifies a Concrete CMS 9.x installation with the Express Objects feature in use and crafts a malicious web page containing a hidden form or JavaScript fetch that auto-submits a forged POST request to the /concrete/controllers/dialog/express/association/reorder endpoint. The attacker then social-engineers an authenticated CMS editor or administrator into visiting the page - upon page load, the victim's browser sends the forged request with the victim's session cookie, causing the CMS to silently reorder Express Object associations without the user's knowledge. No public proof-of-concept code has been identified at time of analysis, but the attack pattern is well-understood for CWE-352 and requires no specialized tooling.