PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8327 Concrete CMS CVE debrief

CVE-2026-8327 affects Concrete CMS account and session controls. The supplied description says the user-profile edit controller forwards the full POST payload to UserInfo::update() without field whitelisting, which allows a logged-in user to change their password without re-entering the current password and can also disable per-user IP-pinning in the session validator. The result is a weakness in both account integrity and hijack-detection hardening.

Vendor
Concrete CMS
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-05-21
Advisory published
2026-05-21
Advisory updated
2026-05-21

Who should care

Administrators, security teams, and application owners running Concrete CMS, especially deployments that allow registered users to edit their profile or rely on per-user IP-pinning to help detect session hijacking.

Technical summary

The NVD record lists CVE-2026-8327 with CVSS v4.0 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) and maps it to CWE-269, CWE-620, and CWE-915. According to the supplied description, the issue is a mass-assignment style flaw: the profile edit controller passes the raw POST array to UserInfo::update() without restricting fields, enabling password changes without current-password reauthorization and allowing registered users to alter session-validator settings such as IP-pinning.

Defensive priority

Medium, but prompt. The published score is moderate, yet the flaw directly affects password-change authorization and session-hardening controls that can materially weaken account security.

Recommended defensive actions

  • Upgrade Concrete CMS to the vendor-fixed release referenced by the 9.5.1 release notes, or a later patched version.
  • Review profile-update code paths to ensure only explicitly allowed fields are accepted from user input.
  • Verify password-change flows require current-password reauthorization where intended.
  • Confirm that session-validator and IP-pinning settings cannot be modified by non-administrative users.
  • Audit recent account/profile change logs for unexpected password changes or session-setting edits.
  • If abuse is suspected, force password resets and invalidate active sessions for affected accounts.

Evidence notes

The supplied NVD record for CVE-2026-8327 cites the Concrete CMS 9.5.1 release notes as a reference and records the issue as a CVSS v4.0 5.3 finding. The source description attributes the problem to raw POST data being passed to UserInfo::update() without field whitelisting, leading to password-change without current-password checks and a bypass of per-user IP-pinning in the session validator.

Official resources

Published in the supplied NVD record on 2026-05-21. The source metadata points to Concrete CMS 9.5.1 release notes as the vendor reference associated with remediation.