PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8327 Concrete CMS CVE debrief

CVE-2026-8327 affects Concrete CMS account and session controls. The supplied description says the user-profile edit controller forwards the full POST payload to UserInfo::update() without field whitelisting, which allows a logged-in user to change their password without re-entering the current password and can also disable per-user IP-pinning in the session validator. The result is a weakness in both account integrity and hijack-detection hardening.

Vendor
Concrete CMS
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-07-23
Advisory published
2026-05-21
Advisory updated
2026-07-23

Who should care

Administrators, security teams, and application owners running Concrete CMS, especially deployments that allow registered users to edit their profile or rely on per-user IP-pinning to help detect session hijacking.

Technical summary

The NVD record lists CVE-2026-8327 with CVSS v4.0 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) and maps it to CWE-269, CWE-620, and CWE-915. According to the supplied description, the issue is a mass-assignment style flaw: the profile edit controller passes the raw POST array to UserInfo::update() without restricting fields, enabling password changes without current-password reauthorization and allowing registered users to alter session-validator settings such as IP-pinning.

Defensive priority

Medium, but prompt. The published score is moderate, yet the flaw directly affects password-change authorization and session-hardening controls that can materially weaken account security.

Recommended defensive actions

  • Upgrade Concrete CMS to the vendor-fixed release referenced by the 9.5.1 release notes, or a later patched version.
  • Review profile-update code paths to ensure only explicitly allowed fields are accepted from user input.
  • Verify password-change flows require current-password reauthorization where intended.
  • Confirm that session-validator and IP-pinning settings cannot be modified by non-administrative users.
  • Audit recent account/profile change logs for unexpected password changes or session-setting edits.
  • If abuse is suspected, force password resets and invalidate active sessions for affected accounts.

Evidence notes

The supplied NVD record for CVE-2026-8327 cites the Concrete CMS 9.5.1 release notes as a reference and records the issue as a CVSS v4.0 5.3 finding. The source description attributes the problem to raw POST data being passed to UserInfo::update() without field whitelisting, leading to password-change without current-password checks and a bypass of per-user IP-pinning in the session validator.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8327 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8327

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8327 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8327

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

    ff5b8ace-8b95-4078-9743-eac1ca5451de

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.