Is there a patch available for CVE-2026-8416?

Yes, a patch is available for CVE-2026-8416. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8416

Q: What is the CVSS score of CVE-2026-8416?

CVE-2026-8416 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31372 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-qj94-6rx6-27fr

CSRF Concrete Cms

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:37 vuln.today

DescriptionCVE.org

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Cross-Site Request Forgery in Concrete CMS 9.x allows a remote unauthenticated attacker to forge state-changing requests against the file manager's addFavoriteFolder endpoint on behalf of an authenticated victim. Exploitation results in low-integrity impact - specifically unauthorized modification of a victim's favorite folder state - without any confidentiality or availability consequences. No public exploit has been identified at time of analysis, and the low CVSS v4.0 score of 2.3 reflects the passive user interaction requirement and constrained impact scope.

Technical ContextAI

Concrete CMS is an open-source PHP content management system. The vulnerable endpoint is concrete/controllers/backend/file at the addFavoriteFolder($id) method, which handles file-manager favorite-folder bookmarking. CWE-352 (Cross-Site Request Forgery) indicates the server fails to validate that a state-changing POST/GET request originated from the legitimate application interface rather than a third-party origin. The CVSS v4.0 vector includes AT:P (Attack Requirements: Present), indicating a non-default precondition exists - in CSRF context this typically means the victim must be actively authenticated to the CMS. The CPE cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* covers all platform/architecture variants of Concrete CMS up to the fixed version.

RemediationAI

Upgrade Concrete CMS to version 9.5.0 or later per the CVE description, with version 9.5.1 referenced in the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes - given the discrepancy between EUVD (≤9.5.0 affected) and CVE description (<9.5.0 affected), administrators should target 9.5.1 as the safest confirmed state. If an immediate upgrade is not feasible, a compensating control is to restrict access to the /concrete/controllers/backend/file endpoint at the web server or reverse proxy layer (e.g., block the addFavoriteFolder route for unauthenticated origins), though this may disable the favorite folder feature for all users. A WAF rule enforcing CSRF token validation or same-origin request checking on this endpoint path can also reduce risk with minimal functional trade-off. These compensating controls are temporary mitigations and do not substitute for patching.