Vulnerability · Published May 21, 2026 · Assigned by ConcreteCMS
CVE-2026-8327Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.
Medium 5.3
In plain English
A medium-severity privilege mismanagement in Concrete CMS from Concrete CMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks 0x4c616e for reporting.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | concrete5/concrete5 | 9.5.1 | GHSA-wmw3-3fv3-h54w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Concrete CMS | Concrete CMS | 5 – through 9.5.0 |
Weakness: CWE-915, CWE-620, CWE-269 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N