PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8413 Concrete CMS CVE debrief

CVE-2026-8413 is a Cross Site Request Forgery (CSRF) issue in Concrete CMS 9 before 9.5.0, affecting concrete/controllers/dialog/page/bulk/design. The vendor-assigned CVSS v4.0 score is 2.3 (LOW), reflecting that the impact is limited but still capable of causing unintended changes when a victim with an active session is tricked into submitting a request. The record credits Yonatan Drori (Tenzai) for reporting.

Vendor
Concrete CMS
Product
Unknown
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-07-23
Advisory published
2026-05-21
Advisory updated
2026-07-23

Who should care

Administrators and operators running Concrete CMS 9 installations before 9.5.0, especially environments where browser-based admin or page-design workflows are used.

Technical summary

The supplied CVE data describes a CSRF weakness in the concrete/controllers/dialog/page/bulk/design path. The issue affects Concrete CMS 9 prior to 9.5.0 and maps to CWE-352 in the source metadata. NVD lists the CVSS v4.0 vector as AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating that successful abuse requires user interaction and can lead to limited integrity impact.

Defensive priority

Low, but worth routine patching. If you run Concrete CMS 9, move to 9.5.0 or later as part of normal maintenance and prioritize any instance that exposes admin or page-management functionality to active browser sessions.

Recommended defensive actions

  • Upgrade Concrete CMS 9 to version 9.5.0 or later.
  • Confirm all production and staging instances are on a fixed version, including any forgotten or backup deployments.
  • Review access controls for page-design and bulk-edit workflows so only intended administrative users can reach them.
  • After upgrading, sanity-check page design and bulk action behavior in a test environment before broad rollout.

Evidence notes

The official NVD record for CVE-2026-8413 states the issue is a CSRF flaw in concrete/controllers/dialog/page/bulk/design and links to Concrete CMS 9.5.0 release notes as the vendor reference. The supplied CVE description says the affected range is Concrete CMS 9 before 9.5.0 and gives the vendor CVSS v4.0 score of 2.3. The CVE was published and modified on 2026-05-21 in the supplied timeline.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8413 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8413

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8413 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8413

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

    ff5b8ace-8b95-4078-9743-eac1ca5451de

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.