CVE-2026-8327

Katalog CVE

CVSS 4.3 · Medium EPSS 0,31%

Kerentanan Improper Privilege Management pada concretecms concrete cms. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password  and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking.  The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks 0x4c616e for reporting.

Rincian

Terbit di NVD

21 Mei 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-620: Unverified Password Change
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes release notes