Is there a patch available for CVE-2026-8415?

Yes, a patch is available for CVE-2026-8415. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8415

Q: What is the CVSS score of CVE-2026-8415?

CVE-2026-8415 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31371 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-xj25-753j-wgp9

CSRF Concrete Cms

2.3

CVSS 4.0 · Vendor: ConcreteCMS

Severity by source

Vendor (ConcreteCMS) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ConcreteCMS) · only source for this CVE.

CVSS VectorVendor: ConcreteCMS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:37 vuln.today

DescriptionCVE.org

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Cross-Site Request Forgery in Concrete CMS 9.x allows a remote unauthenticated attacker to trigger unauthorized reordering of Express Object associations by tricking an authenticated user into visiting a crafted page. The vulnerability targets the endpoint concrete/controllers/dialog/express/association/reorder, with impact limited to low-severity integrity modification of the vulnerable system only. No public exploit has been identified at time of analysis, and the low CVSS v4.0 score of 2.3 reflects the combination of required user interaction, specific prerequisite conditions (AT:P), and limited data impact.

Technical ContextAI

Concrete CMS is a PHP-based content management system. The affected endpoint (concrete/controllers/dialog/express/association/reorder) is part of the Express Objects subsystem, a feature that allows developers to define custom data objects and associations within the CMS. CWE-352 (Cross-Site Request Forgery) describes a class of vulnerabilities where a web application does not sufficiently verify that a request was intentionally made by the authenticated user. In this case, the reorder endpoint appears to lack CSRF token validation, meaning a forged cross-origin request submitted on behalf of a logged-in user would be processed as legitimate. The CPE string (cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:*) confirms this affects the canonical ConcreteCMS application. The CVSS 4.0 vector introduces the AT:P (Attack Requirements: Present) field, indicating specific deployment or user-state preconditions beyond just having a logged-in session - likely that the victim must have access to the Express associations management area.

RemediationAI

Upgrade Concrete CMS to version 9.5.0 or later; the reference URL https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes points to the 9.5.1 release notes, suggesting 9.5.1 may be the definitive patched release - organizations should target 9.5.1 or the latest available 9.x release to resolve this and any subsequent issues. Given the low impact of the vulnerability (limited to integrity of Express association ordering), immediate emergency patching is not warranted for most environments, but the fix should be included in the next scheduled CMS maintenance cycle. If patching is delayed, a compensating control is to restrict access to the Express Objects management interface to trusted administrator roles only and ensure that users with Express association management permissions are educated about phishing and cross-site attacks. No meaningful network-level blocking is applicable since the endpoint is a legitimate application feature.