CVE-2026-8413: low-severity vulnerability in Concrete CMS
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Concrete CMS 9 before version 9.5.0 has a weakness that allows attackers to trick users into performing unwanted bulk design changes on pages without their knowledge. An attacker can craft a malicious link that, when clicked by a logged-in CMS user, silently modifies page designs.
CSRF vulnerability in the bulk page design dialog endpoint (concrete/controllers/dialog/page/bulk/design) allows an attacker to forge requests on behalf of authenticated users. Attack requires user interaction (clicking a malicious link) and results in unauthorized modification of page integrity. No authentication token validation is performed on state-changing operations.
In the same product, most dangerous first.