PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8413 Concrete CMS CVE debrief

CVE-2026-8413 is a Cross Site Request Forgery (CSRF) issue in Concrete CMS 9 before 9.5.0, affecting concrete/controllers/dialog/page/bulk/design. The vendor-assigned CVSS v4.0 score is 2.3 (LOW), reflecting that the impact is limited but still capable of causing unintended changes when a victim with an active session is tricked into submitting a request. The record credits Yonatan Drori (Tenzai) for reporting.

Vendor
Concrete CMS
Product
Unknown
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-05-21
Advisory published
2026-05-21
Advisory updated
2026-05-21

Who should care

Administrators and operators running Concrete CMS 9 installations before 9.5.0, especially environments where browser-based admin or page-design workflows are used.

Technical summary

The supplied CVE data describes a CSRF weakness in the concrete/controllers/dialog/page/bulk/design path. The issue affects Concrete CMS 9 prior to 9.5.0 and maps to CWE-352 in the source metadata. NVD lists the CVSS v4.0 vector as AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating that successful abuse requires user interaction and can lead to limited integrity impact.

Defensive priority

Low, but worth routine patching. If you run Concrete CMS 9, move to 9.5.0 or later as part of normal maintenance and prioritize any instance that exposes admin or page-management functionality to active browser sessions.

Recommended defensive actions

  • Upgrade Concrete CMS 9 to version 9.5.0 or later.
  • Confirm all production and staging instances are on a fixed version, including any forgotten or backup deployments.
  • Review access controls for page-design and bulk-edit workflows so only intended administrative users can reach them.
  • After upgrading, sanity-check page design and bulk action behavior in a test environment before broad rollout.

Evidence notes

The official NVD record for CVE-2026-8413 states the issue is a CSRF flaw in concrete/controllers/dialog/page/bulk/design and links to Concrete CMS 9.5.0 release notes as the vendor reference. The supplied CVE description says the affected range is Concrete CMS 9 before 9.5.0 and gives the vendor CVSS v4.0 score of 2.3. The CVE was published and modified on 2026-05-21 in the supplied timeline.

Official resources

Publicly disclosed in the CVE record on 2026-05-21. The record credits Yonatan Drori (Tenzai) for reporting. No KEV listing was provided in the supplied enrichment.