Is there a patch available for CVE-2026-8435?

Yes, a patch is available for CVE-2026-8435. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8435

Q: What is the CVSS score of CVE-2026-8435?

CVE-2026-8435 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31363 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-44q4-354f-c826

CSRF Concrete Cms

2.3

CVSS 4.0 · Vendor: ConcreteCMS

Severity by source

Vendor (ConcreteCMS) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ConcreteCMS) · only source for this CVE.

CVSS VectorVendor: ConcreteCMS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:40 vuln.today

DescriptionCVE.org

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Cross-Site Request Forgery in Concrete CMS versions 9.0 through 9.5.0 exposes the approveVersion() backend file management endpoint to forged requests, allowing an unauthenticated remote attacker to manipulate file version approval state on behalf of an authenticated victim. The vendor's own CVSS v4.0 scoring assigns a 2.3 (Very Low) severity, reflecting the constrained impact - limited to low integrity change within the vulnerable component with no confidentiality or availability consequence. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, positioning this as a low-priority but legitimately tracked integrity weakness in CMS file workflows.

Technical ContextAI

Concrete CMS is a PHP-based content management system. The vulnerability resides in the backend file management controller located at concrete/controllers/backend/file, specifically within the approveVersion() method, which performs a state-changing operation (promoting a file version to approved status) without adequate verification that the HTTP request originated from the authenticated session owner. CWE-352 (Cross-Site Request Forgery) identifies the root cause class: the application relies on implicit browser credential transmission (session cookies) rather than requiring an unpredictable, per-request token tied to the user session. The affected CPE cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* confirms this is an application-layer weakness in the CMS software itself, not an underlying framework or OS dependency. The CVSS v4.0 vector component AT:P (Attack Requirements: Present) signals that the attack requires a precondition - specifically, an attacker-controlled page that the authenticated victim must load - while UI:P (User Interaction: Passive) confirms the victim need only visit a malicious URL without further active steps.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later - the vendor's release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes document the fix for this issue. Note the version discrepancy: the CVE description cites 9.5.0 as the threshold, but the reference URL targets the 9.5.1 release notes, so 9.5.1 should be treated as the confirmed remediated version until the vendor clarifies. If immediate upgrade is not possible, restrict network access to the backend file management interface (/index.php/ccm/system/backend/file or equivalent) to known trusted IP ranges via firewall or reverse proxy ACL - this reduces CSRF exposure by limiting who can reach the endpoint. Additionally, enforcing SameSite=Strict on session cookies at the web server or load balancer level will block cross-origin forged requests; be aware this may break legitimate cross-domain SSO or embedded integrations if present. Educating CMS editors and administrators about phishing-linked CSRF risks provides a lightweight compensating control during patch windows.