CVE-2026-8340 - Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion

Back Back to CVE browser

LOW

Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion

Published May 22, 2026

2.3

LOW

CVSS 4.0

EPSS 0.15%

Description

Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd into publishing an attacker-chosen previously-uploaded version (downgrade to an older version of a file, or activation of a co-editor's unpublished version). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

Affected products

Vendor Concrete CMS Product Concrete CMS Default
unaffected
- Version
  5.0
  Status
  affected
  Constraints
  <=9.5.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Concrete CMS

unaffected

Version	Status	Constraints
5.0	affected	<=9.5.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (4)

https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes
release-notesRelease Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31441
Advisory
https://github.com/advisories/GHSA-xjg6-5v39-v7fc
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8340

Link	Providers	Tags
https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes		release-notesRelease Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31441		Advisory
https://github.com/advisories/GHSA-xjg6-5v39-v7fc		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8340