PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8435 Concrete CMS CVE debrief

CVE-2026-8435 describes a cross-site request forgery issue in Concrete CMS 9 before 9.5.0 affecting the file version approval controller action concrete/controllers/backend/file approveVersion(). NVD assigns a low CVSS v4.0 score of 2.3 and lists CWE-352 along with CWE-1275. The issue was publicly recorded on 2026-05-21, and the supplied vendor reference points to Concrete CMS 9.5.0 release notes as the remediation context.

Vendor
Concrete CMS
Product
Unknown
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-07-23
Advisory published
2026-05-21
Advisory updated
2026-07-23

Who should care

Administrators and developers running Concrete CMS 9 versions older than 9.5.0, especially environments that use backend file version approval workflows.

Technical summary

The vulnerability is a CSRF flaw in the backend file approval path. NVD classifies it with CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating network reachability, required user interaction, no privileges, and limited integrity impact. The supplied weakness data maps to CWE-352 and CWE-1275.

Defensive priority

Low

Recommended defensive actions

  • Upgrade Concrete CMS 9 to 9.5.0 or later.
  • Review the backend file approval workflow for CSRF protections and confirm state-changing requests require valid anti-CSRF tokens.
  • Verify that approval actions are only reachable through intended authenticated interfaces and are not exposed through unsafe request handling.
  • Check logs and audit records for unexpected file version approval events around the affected endpoint.
  • If immediate upgrading is not possible, restrict access to backend administration paths until remediation is complete.

Evidence notes

Supplied CVE data states: Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in concrete/controllers/backend/file approveVersion(). The CVSS v4.0 vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N with score 2.3 and severity LOW. Timeline fields show the CVE was published and modified on 2026-05-21T22:16:52.053Z. The NVD source metadata marks the record as Received and includes the Concrete CMS 9.5.0 release notes as a reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8435 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8435

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8435 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8435

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

    ff5b8ace-8b95-4078-9743-eac1ca5451de

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.