CVE-2026-8327
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks 0x4c616e for reporting.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.18%
- CWE
- CWE-915, CWE-620, CWE-269
- Published
- 2026-05-21
- Last modified
- 2026-05-22
Affected products
- Concrete CMS Concrete CMS
Weakness type
Related vulnerabilities
- CVE-2026-85408 — Eleveo Quality Management Conversation events dynamically-determined object attributes
- CVE-2026-84430 — gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes
- CVE-2026-83557 — jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
- CVE-2026-78038 — Job argument injection via :args overrides primary_key and tenant in AshOban
- CVE-2026-77144 — Broken Access Control in extension "Events 2" (events2)
- CVE-2026-71504 — Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
- CVE-2026-78416 — Authenticated RCE via `condition.config` JSON cleanse bypass
- CVE-2026-62315 — Frappe: Mass assignment via set_value