GHSA-8c7c-h7px-267g CVE-2026-8337
Concrete CMS is vulnerable to IDOR in surveys
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.19%
- Chance of exploitation in the next 30 days. Higher than 9.15% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-565 Reliance on Cookies without Validation and Integrity Checking
- Fix
9.5.1- Upgrade concrete5/concrete5 to this version or later
Description
Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by submitting the restricted optionID through the public survey’s endpoint.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| concrete5/concrete5 | < 9.5.1 |
9.5.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
concrete5/concrete5 Packagist → 9.5.1
- composer
composer require concrete5/concrete5:^9.5.1
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-565: Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
How to prevent it
- Architecture and Design: Avoid using cookie data for a security-related decision.
- Implementation: Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
- Architecture and Design: Add integrity checks to detect tampering.
- Architecture and Design: Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-g82f-9pw7-773w Concrete CMS: PHP Object Injection via unserialize() calls | High | Also affects concrete5/concrete5 |
| GHSA-52pr-7vmf-2w7x Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components | High | Also affects concrete5/concrete5 |
| GHSA-q9fm-mpg8-8jqm Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme | Medium | Also affects concrete5/concrete5 |
| GHSA-jqvq-gv67-3567 Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog | Medium | Also affects concrete5/concrete5 |
| GHSA-xjg6-5v39-v7fc Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion | Medium | Also affects concrete5/concrete5 |
| GHSA-44q4-354f-c826 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() | Medium | Also affects concrete5/concrete5 |
| GHSA-6qjh-p324-694f Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() | High | Also affects concrete5/concrete5 |
| GHSA-6fxm-r8p3-mx5c Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() | High | Also affects concrete5/concrete5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor