Is there a patch available for CVE-2026-8433?

Yes, a patch is available for CVE-2026-8433. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8433

Q: What is the CVSS score of CVE-2026-8433?

CVE-2026-8433 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31365 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-6fxm-r8p3-mx5c

CSRF Concrete Cms

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:38 vuln.today

DescriptionCVE.org

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

CSRF vulnerability in Concrete CMS 9.x exposes the backend file rescan controller at concrete/controllers/backend/file to unauthorized state-changing requests. Affecting versions 9.0 through 9.4.x (patched in 9.5.1), an unauthenticated remote attacker can trigger unintended file rescan operations against an authenticated victim's session by luring them to a malicious page. Rated CVSS v4.0 at 2.3 - limited to low integrity impact with no confidentiality or availability consequence - and no public exploit identified at time of analysis.

Technical ContextAI

The root cause is CWE-352 (Cross-Site Request Forgery): the file rescan backend endpoint fails to verify that incoming HTTP requests originate from the legitimate authenticated user rather than a forged cross-origin request. Browsers automatically attach session cookies to same-origin and cross-site requests, enabling an attacker-controlled page to silently submit state-changing requests on behalf of a logged-in victim. The affected component is specifically the rescan() method within concrete/controllers/backend/file, a backend administrative controller in the Concrete CMS PHP content management platform. The CPE string cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* covers all Concrete CMS 9.x releases up to the fix. The CVSS v4.0 Attack Requirements field AT:P (Present) reflects that a prerequisite condition - an authenticated session - must exist for exploitation.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, as indicated by the vendor's 9.5.1 release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. This is a vendor-released patch and represents the primary recommended fix. If an immediate upgrade is not feasible, a compensating control is to restrict access to the /concrete/controllers/backend/file rescan endpoint at the web server or WAF layer, limiting it to trusted IP ranges - note this may impact legitimate administrative file management workflows. Additionally, ensuring that administrative users follow strict session hygiene (logging out after use, avoiding concurrent browsing during admin sessions) reduces the practical exploitation surface for this and other CSRF-class issues. No known workarounds fully substitute for the patch.