VYPR
← All advisories
Low severityNVD Advisory· Published May 21, 2026

CVE-2026-8435

CVE-2026-8435

Description

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Concrete CMS versions before 9.5.0 have a low-severity CSRF vulnerability in the file approveVersion() controller endpoint, allowing unauthorized file version approval.

Vulnerability

Overview

Concrete CMS 9 prior to version 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) in the concrete/controllers/backend/file approveVersion() controller. This endpoint lacks proper CSRF protection, enabling an attacker to trick an authenticated admin into approving a file version without their consent.

Exploitation

Prerequisites

Exploitation requires an authenticated admin user to click on a crafted link or visit a malicious page while logged in to the CMS. The attack can be performed over the network without authentication but requires a user interaction step. The CVSS v4.0 score of 2.3 (low) reflects these constraints, including a low attack complexity but a need for active user participation [1].

Impact

If successfully exploited, an attacker can cause an unauthorized approval of a file version, potentially bypassing content review processes. No data confidentiality is compromised, but the integrity of file approvals can be affected.

Mitigation

The vulnerability is fixed in Concrete CMS version 9.5.0 and later [1]. Users should upgrade to at least version 9.5.0 or apply a security patch from the vendor. No workarounds are documented.

References
  1. 9.5.1 Release Notes

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

36