PT-2026-42773 · Unknown · Concrete Cms

Winston Crooker · CVE-2026-8347 · Published 2026-05-22 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.1

Description An Insecure Direct Object Reference (IDOR) and incorrect authorization level exist in the Express association Reorder dialog. This allows for cross-entity state tampering, where a user with view-only permissions on one entry can modify the state of another entity. This issue affects websites utilizing the Express module and relying on express entity ordering.

Recommendations Update Concrete CMS to version 9.5.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-8347

GHSA-JQVQ-GV67-3567

Affected Products

Concrete Cms

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8347.json · Exploit
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-8347 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqvq-gv67-3567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8347 · Security Note
• https://github.com/concretecms/concretecms · Note